yashbhalgat HashNeRF-pytorch Checkpoint Deserialization Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in yashbhalgat HashNeRF-pytorch versions up to commit 82885e698295982504eb6a26d060a6b2473e3706. The issue arises in the Checkpoint File Handler component, specifically within the run_nerf.py file, where the torch.load function is used to load checkpoint files. This deserialization process can be exploited locally by manipulating the ckpt_path argument, potentially leading to arbitrary code execution.

Impact

Exploitation of this vulnerability allows for arbitrary code execution as the user executing the Python script. In machine learning environments, this could expose local datasets, model weights, environment variables, API tokens, SSH keys, cloud credentials, and other training artifacts.

Reproduction

The vulnerability can be reproduced by loading an untrusted checkpoint file using the --ft_path argument or by placing a malicious .tar checkpoint in a shared experiment or log directory. Once the checkpoint is loaded with torch.load, any embedded code can be executed in the context of the running process.

Remediation

Users are advised to avoid loading untrusted checkpoint files and to use PyTorch's safe-loading options when available. Checkpoint integrity and signatures should be verified when obtained from external or shared sources.