Unsafe Deserialization in docTR via Malicious Pickle Payload

Executive Summary

docTR through 1.1.0 has an unsafe deserialization flaw in the load_pretrained_params() function. It uses torch.load without the weights_only=True parameter, allowing attackers who control a checkpoint file (local or URL) to embed malicious pickle code. This can execute arbitrary Python code during the loading process, but only affects torch releases before version 2.6.

Useful 0 Not Useful 0

Detection Guidance

Check for unsafe deserialization in docTR by inspecting code using torch.load without weights_only=True. Look for checkpoint files loaded from untrusted sources or URLs. Monitor for unexpected Python code execution during model loading.

Useful 0 Not Useful 0

Impact Analysis

If you use docTR 1.1.0 or earlier and load untrusted checkpoints, attackers could exploit this to run malicious code on your system. This could lead to data theft, system compromise, or further network attacks. The impact depends on the privileges of the process loading the checkpoint.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches. For GDPR, this may result in non-compliance due to unauthorized access to personal data. For HIPAA, it could violate safeguards for protected health information if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to torch 2.6 or later. Ensure all checkpoint loading uses torch.load with weights_only=True. Avoid loading checkpoints from untrusted sources. Validate checkpoint integrity before loading.

Useful 0 Not Useful 0