aslein1413/poc-torch-package-rce

PoC — code execution when loading a torch.package archive

torch.package.PackageImporter(path).load_pickle(...) unpickles with a fully unrestricted unpickler. Unlike torch.load (which defaults to weights_only=True), this API has no safe option at all, so loading an untrusted package runs code.

evil_importtime.pt is the self-contained variant: the archive interns its own module, and the pickled object only references a class in it. Resolving that class runs the module's top-level code from inside the archive, so no external module and no denylisted global is needed.

Files

• evil_importtime.pt — malicious package; loading it runs code and writes /tmp/MARKER_importtime.txt.
• verify.py — loads it with the standard PackageImporter(...).load_pickle("data","obj.pkl").
• build.py — how the package was authored (torch.package.PackageExporter).

Reproduce

pip install torch
python verify.py
# marker after : True
# import-time-RCE uid=0

Confirmed on a clean python:3.12-slim container with stock torch 2.13.0 (uid=0).

Why it matters

Any code that loads a user-supplied torch.package runs attacker code as the host process, on the default and only load path. There is no pickle blob for a scanner to flag in the import-time variant, so ModelScan reports it clean.