docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/mindee/doctr/blob/v1.1.0/doctr/models/utils/pytorch.py
disclosure@vulncheck.com
https://github.com/mindee/doctr/commit/687503dd15592483c4699ee51280b41938579a9e
disclosure@vulncheck.com
https://github.com/mindee/doctr/issues/2175
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/doctr-through-1.1.0-unsafe-deserialization…
disclosure@vulncheck.com