{"id":232,"date":"2026-10-29T07:23:25","date_gmt":"2026-10-29T07:23:25","guid":{"rendered":"https:\/\/bugskan.com\/?p=232"},"modified":"2026-10-29T07:23:25","modified_gmt":"2026-10-29T07:23:25","slug":"transformers-trainer-checkpoint-flaw-depended-on-the-pytorch-version-in-use","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/transformers-trainer-checkpoint-flaw-depended-on-the-pytorch-version-in-use\/","title":{"rendered":"Transformers Trainer checkpoint flaw depended on the PyTorch version in use"},"content":{"rendered":"<p>The Transformers advisory describes unsafe checkpoint loading in Trainer\u2019s RNG-state restoration. A malicious checkpoint file could reach torch.load without the weights-only restriction and execute code when loaded in the affected workflow.<\/p>\n<p>The advisory identifies the relevant combination as Transformers releases supporting torch 2.2 or later, used with PyTorch below 2.6. Its listed Transformers affected range is below 5.0.0rc3, with that release providing the fix.<\/p>\n<p>Use maintained, patched dependencies and avoid loading untrusted training checkpoints in a privileged environment. Check both Transformers and PyTorch versions; a headline naming only PyTorch obscures which library workflow and dependency combination creates this risk.<\/p>\n<p><a href=\"https:\/\/github.com\/advisories\/GHSA-69w3-r845-3855\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE-2026-1839 involved unsafe loading of RNG state from an attacker-controlled checkpoint, rather than a generic PyTorch service breach.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_5efc8b7c39d04f","bugskan_event_type":"vulnerability","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"Affected Trainer RNG-state loading with PyTorch below 2.6 as described in the advisory.","bugskan_recommended_next_step":"Update affected dependencies and isolate untrusted checkpoint loading.","bugskan_who_should_check":"","bugskan_material_updated_at":"2026-04-07T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[57],"class_list":["post-232","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-hugging-face-transformers"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=232"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/232\/revisions"}],"predecessor-version":[{"id":388,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/232\/revisions\/388"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=232"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=232"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}