An attacker who can provide a malicious checkpoint file - either via local storage or a remote URL - can embed a malicious pickle payload within the file. When load_pretrained_params() processes this file, the underlying PyTorch mechanism (on versions prior to 2.6) will deserialize the payload, resulting in arbitrary Python code execution under the security context of the user or service running the docTR library. This vulnerability is significant for environments where document processing pipelines ingest user-supplied model files or rely on potentially compromised remote storage.

Impact

Successful exploitation of this vulnerability allows an attacker to achieve arbitrary code execution on the system running the docTR library. This could lead to a full compromise of the application server, data exfiltration from the processing environment, or lateral movement within the network. The scope affects any application utilizing docTR version 1.1.0 or earlier for OCR tasks.

Recommendation

• Update docTR to a version that enforces weights_only=True in load_pretrained_params().
• If patching is not immediately feasible, audit the code to ensure load_pretrained_params() is only ever called with trusted, verified local model files.
• Verify the PyTorch version in the environment and ensure it is updated to 2.6 or later to benefit from improved default deserialization safety.
• Implement file integrity monitoring on any directory where model checkpoints are stored to detect unauthorized modifications.