Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

torch.load in the runner will throw warning due to ACE security vuln #42

Open
KyleM73 opened this issue Oct 13, 2024 · 0 comments
Open

Comments

@KyleM73
Copy link

KyleM73 commented Oct 13, 2024

torch.load allows arbitrary code execution when the argument weights_only is set to False (default). The default value will switch to True in a future torch release. People wishing to get rid of the error (and eliminate the risk of ACE when loading files you did not train yourself) can change the torch.load call in the runner.load method to include the argument weights_only=True as a default.

Specifically:

def load(self, path, load_optimizer=True):
        loaded_dict = torch.load(path)

should become

def load(self, path, load_optimizer=True):
        loaded_dict = torch.load(path, weights_only=True)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant