The vulnerability resides in the function load_pretrained_params(), which uses torch.load to deserialize checkpoint files without the weights_only=True flag. Because torch.load can evaluate pickle payloads, an attacker who can control a local or URL-supplied checkpoint can embed malcrafted pickle data that executes arbitrary Python code with the privileges of the process loading the checkpoint. This flaw enables an attacker to gain full code‑execution control on the host running the model inference; the risk is significant, as the code runs with the same privileges as the loader, potentially allowing access to sensitive data or further exploitation. The weakness is categorized as CWE‑502.

Mindee:docTR version 1.1.0 is affected. No other versions or products are listed in the CNA data; therefore, systems running this specific release are the only known impacted ones.

The CVSS score is 7.7, representing high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread public exploitation data is known. The likely attack vector involves an attacker supplying a crafted checkpoint file, either via a local file path or a remote URL, to the load_pretrained_params() routine. Exploitation requires that the environment uses a torch release prior to version 2.6, which currently is an open condition for many deployments.