title: ModelCache torch.load() Deserialization RCE (CVE-2025-45146)
id: ATR-2026-00433
rule_version: 1
status: experimental
description: |
  Detects exploitation of CVE-2025-45146 (CVSS 9.8), arbitrary code execution in ModelCache for LLM through v0.2.0 via deserialization in `/manager/data_manager.py`. ModelCache calls torch.load() (PyTorch's pickle-backed deserialization) on attacker-supplied data; pickle's __reduce__ machinery allows code execution at load time. Detects the malicious pickle / torch payload patterns at content level and the unsafe torch.load() invocation patterns at code level. CWE-502.
author: ATR Community
date: 2026/05/10
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM03:2025
    - LLM05:2025
  owasp_agentic:
    - ASI04:2026
    - ASI05:2026
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
    - AML.T0011.000 - Unsafe AI Artifacts
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
    - T1195.002 - Compromise Software Supply Chain
  cve:
    - CVE-2025-45146
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2025-45146 ModelCache deserialises untrusted user-supplied data via torch.load()/pickle, enabling RCE at model-load time; Article 15 cybersecurity requirements mandate that AI systems neutralise pickle-based deserialisation of untrusted input across model-cache pipelines.
      strength: primary
    - article: '10'
      context: Article 10 data-governance obligations require provenance and integrity controls on cached model artifacts, since torch.load consumes pickle bytes that can carry arbitrary code reduce-payloads.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the model-security attack (ModelCache torch.load() Deserialization RCE (CVE-2025-45146)).
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Adversarial input attacks via pickle deserialisation of untrusted model-cache artifacts must be enumerated as a primary supply-chain attack surface.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment under MG.2.3 must mandate weights_only=True on torch.load and reject pickle-format artifacts originating from untrusted networks or user uploads.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the model-security attack (ModelCache torch.load() Deserialization RCE (CVE-2025-45146)).
      strength: primary
    - subcategory: MS.2.6
      context: NIST AI RMF MEASURE 2.6 (system evaluated regularly for safety risks) is supported by this rule's detection of the model-security attack (ModelCache torch.load() Deserialization RCE (CVE-2025-45146)).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must include detection of torch.load / pickle.load invocations on attacker-controlled paths within model-cache and embedding-store components.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the model-security attack (ModelCache torch.load() Deserialization RCE (CVE-2025-45146)) is such a treatment.
      strength: secondary
tags:
  category: model-abuse
  subcategory: pickle-deserialization-rce
  scan_target: both
  confidence: high
agent_source:
  type: llm_io
  framework:
    - modelcache
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Defensive guidance recommending weights_only=True for torch.load.
    - Static analysis output reporting pickle.load usage in code review.
    - Educational examples demonstrating pickle exploit theory in academic contexts.
  conditions:
    - field: content
      operator: regex
      value: (?i)torch\.load\s*\([^,)]*(?:request\.|flask\.request|user_input|untrusted|attacker|payload|upload|f\.read\(\)|response\.content)[^)]{0,200}\)
      description: torch.load called on attacker-derived input — direct CVE-2025-45146 sink
    - field: content
      operator: regex
      value: (?i)torch\.load\s*\((?![^)]*weights_only\s*=\s*True)[^)]*(?:request\.|flask\.request|user_input|untrusted|attacker|payload|upload|response\.content|f\.read\(\)|self\.\w+\.read\(\))[^)]*\)
      description: torch.load on attacker-derived input AND missing weights_only=True — exposed to pickle reduce code execution
    - field: content
      operator: regex
      value: (?i)pickle\.(?:load|loads)\s*\(\s*(?:request\.|flask\.request|user_input|untrusted|attacker|payload|upload|response\.content|self\.\w+\.read\(\))
      description: pickle.load on untrusted input — generic deserialisation RCE precursor that includes the ModelCache class
    - field: content
      operator: regex
      value: (?i)def\s+__reduce__\s*\(\s*self\s*\)\s*:[\s\S]{0,200}return\s*\(\s*(?:os\.system|os\.popen|subprocess\.\w+|exec|eval|__import__\s*\(\s*["\x27]os)
      description: Custom __reduce__ returning OS-execution callable — pickle bomb construction signature
    - field: content
      operator: regex
      value: (?i)\\x80\\x04(?:\\x95|.).{0,40}c(?:posix|os|subprocess|__builtin__|builtins)\s*\n(?:system|popen|run|exec)
      description: Pickle opcode stream containing GLOBAL/REDUCE of os/subprocess — raw pickle-bomb signature
    - field: content
      operator: regex
      value: (?i)modelcache[^\n]{0,80}(?:data_manager|/manager/)[^\n]{0,200}(?:torch\.load|pickle|deseriali[sz]e|unpickl|rce|cve-?2025-?45146)
      description: Skill/payload referencing ModelCache data_manager.py deserialisation — explicit CVE-2025-45146 framing
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00433] CRITICAL: ModelCache-class pickle/torch deserialisation RCE pattern detected (CVE-2025-45146, CVSS 9.8). torch.load() / pickle.load() is reaching attacker-controlled bytes, OR a __reduce__ payload constructs OS-execution at load time, OR the pickle opcode stream itself shows a GLOBAL of os/subprocess. Refuse to load; require weights_only=True and safetensors format for all cache artifacts on the network path.
confidence: 86