The torch-checkpoint-shrink.py script fails to set the security‑restrictive weights_only=True parameter when calling torch.load(), allowing arbitrary Python objects to be deserialized via pickle. This flaw is classified as CWE‑502 (Insecure Deserialization). An attacker who can supply a maliciously crafted .pt checkpoint file can trigger the script to execute arbitrary code in the environment of the user running the script, leading to complete compromise of that system.

The vulnerability exists in the open‑source ml‑engineering project, specifically the torch-checkpoint-shrink.py script. Any installation of this script that is capable of processing external checkpoint files is affected; there are no vendor or product version details provided beyond the open‑source repository identifier.

With an EPSS score of <1% and not listed in CISA KEV, the CVSS score of 9.8 confirms an extremely high severity for arbitrary code execution. The lack of the weights_only parameter makes the script vulnerable to pickle deserialization of malicious objects. Because the attacker must provide a crafted checkpoint file to the script, exploitation is limited to scenarios where the script processes untrusted data; nevertheless, once executed the attack achieves full control of the running process.