CVE-2026-117510

Dexbotic checkpoint shard paths can load tensors outside the package

Dexmal · Dexbotic gr00tsonic checkpoint loader

First documented disclosure · Review checkpoint

Summary

An untrusted checkpoint index can redirect weight loading to a valid safetensors file outside its directory.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources establish a vulnerability and controlled reproduction, not real-world malicious exploitation. CISA KEV 2026.10.27 contains no exact-ID match; absence is not proof of no exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Unvalidated weight_map paths are joined to the checkpoint directory; an absolute path replaces that directory and its tensors are loaded into the model.

Conditions required

An operator loads the crafted checkpoint, and the referenced external safetensors file exists and is readable by the process.

Potential impact

Silent model-weight substitution and limited local-file existence/format disclosure; remote code execution and automatic data exfiltration are not demonstrated.

Affected versions and configurations

CNA lists 0.1 and0.2.0; researcher verified 0.2.0 at 21db59b and reported the same code at 5b22b19.

Fix and mitigation status

No fixed release established in the reviewed sources.

Practical next steps

Reject absolute and escaping shard paths and enforce resolved-path containment; load only trusted checkpoint packages pending a verified fix.

Operating lesson

Safe tensor serialization does not make a package-controlled file path trustworthy.

Evidence and limits

October11 public issue predates October27 CVE. The reproduction deliberately creates an external tensor file and confirms substitution, not arbitrary-file decoding or a victim breach. CNA 5.3/4.0 differs from researcher 7.1/3.1.

Sources