Skip to content

v1.2.1

Choose a tag to compare

View all tags
@FKKimura FKKimura released this 06 Jul 03:43
· 205 commits to main since this release
v1.2.1
70e8905
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[v1.2.1] 2026-07-03

Security

  • Unsafe deserialization hardening (CWE-502): QuantizedModelLoader.load_quantized_model_pt() (alias onecomp.load_quantized_model_pt()) previously called torch.load(model.pt, weights_only=False) unconditionally, allowing arbitrary code execution when loading a malicious .pt checkpoint. It now refuses to load unless the caller explicitly opts in via allow_unsafe_deserialization=True, and emits a strong warning when it does load. For untrusted models, use the safetensors-based load_quantized_model(), which does not execute code.

    • Breaking change: existing callers of load_quantized_model_pt() must pass allow_unsafe_deserialization=True for trusted .pt files.

  • Quantizer.load_results() / ResultLoader: same hardening applied. Loading with weights_only=False now requires allow_unsafe_deserialization=True (added as a ResultLoader field), and logs a warning. The safe weights_only=True path is unchanged.

  • Updated docstrings, docs, and the LoRA SFT example to document the risk and the required opt-in.

  • Credit: this unsafe deserialization issue (CWE-502) was responsibly disclosed by Nir Yehoshua, Cipher Security Labs. Thank you for the report.

Assets 2
Loading