CVE-2026-108947

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been published and may be used. The project maintainer explains: "This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate."

• CWE-20
• CWE-502

• https://github.com/yoshitomo-matsubara/torchdistill/
• https://github.com/yoshitomo-matsubara/torchdistill/issues/550
• https://github.com/yoshitomo-matsubara/torchdistill/issues/550#issuecomment-5826644846
• https://vuldb.com/cve/CVE-2026-108947
• https://vuldb.com/submit/997819
• https://vuldb.com/vuln/416771
• https://vuldb.com/vuln/416771/cti

Published

Oct 13, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108940A vulnerability was found in EricLBuehler Mistral.rs up to 0…6.5
• CVE-2026-108941A vulnerability was identified in Linketic CityGaussian up t…4.8
• CVE-2026-108942A security flaw has been discovered in philz1337x clarity-up…3.5
• CVE-2026-108943A weakness has been identified in ModelTC LightX2V up to 0.5…5.3
• CVE-2026-108944A security vulnerability has been detected in repository RAE…4.8
• CVE-2026-108945A vulnerability was detected in iMoonLab yolov13 up to 73289…5.3
• CVE-2026-108948A vulnerability has been found in code-projects Online Revie…5.4
• CVE-2026-10895Use after free in Ozone in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-108950Open Source Social Network (OSSN) through 10.1 contains a mi…5.3
• CVE-2026-108951LavaLite CMS through 10.1.2 contains an authorization bypass…6.5
• CVE-2026-108952RT-Thread through 5.3.0 contains a memory corruption vulnera…4.6
• CVE-2026-108953mac-shell-mcp before 2.0.0 contains an OS command injection …7.8