Product
docTR versions through 1.1.0 are vulnerable to arbitrary code execution via unsafe deserialization of pickle payloads within the load_pretrained_params() function.