yoshitomo-matsubara CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM yoshitomo-matsubara CVE published 2026-10-13

CVE-2026-108947

A deserialization vulnerability exists in yoshitomo-matsubara torchdistill up to 1.1.5 in the load_ckpt function of torchdistill/common/main_util.py. This issue allows local attackers to execute deserialization attacks by manipulating the src_ckpt argument. The vulnerability can lead to arbitrary code execution, emphasizing the need for defenders to verify affected versions and apply patches or mitigation [truncated]