[Aikido] Fix security issue in torch via minor version upgrade from 2.4.0 to 2.13.0 by aikido-autofix[bot] · Pull Request #2 · pascal-maker/python-opencv

aikido-autofix · 2026-10-12T10:57:45Z

Upgrade PyTorch to fix critical Remote Code Execution vulnerabilities in model loading through unsafe pickle deserialization and weights_only parameter handling.

✅ Code not affected by breaking changes.

✅ After searching through the entire codebase for all breaking changes listed in the torch 2.4.0 => 2.13.0 upgrade changelog, I found that no breaking changes affect this codebase.

The codebase uses torch in the following ways:

torch.no_grad() context manager in motion-dection-security-camera.py
torch.inference_mode() context manager in football_tracking.py and the basketball notebook
torch.cuda.is_available() and torch.backends.mps.is_available() for device detection in football_tracking.py
torch.autocast() in the basketball notebook
Basic tensor operations like .cpu() and .numpy()
torchvision.models.detection.fasterrcnn_resnet50_fpn(pretrained=True) in motion-dection-security-camera.py (note: this uses the deprecated pretrained parameter, but this is a torchvision API issue, not a torch breaking change)

None of the breaking changes from the changelog affect these usage patterns:

No usage of torch.load() (so the weights_only default change doesn't apply)
No usage of ONNX export APIs
No usage of named tensors
No usage of torch.export, torch.hub, quantization APIs, distributed training, custom samplers, or any other deprecated/removed features
No C++ extensions or custom operators
The codebase runs on Python 3.10 (as documented in README.md), which meets the minimum Python 3.10 requirement from torch 2.9.0
The MPS backend usage is basic device detection only; the breaking change about unified memory allocation is unlikely to cause issues

The only potential concern is the environment uses Apple M2 Max with MPS backend, and torch 2.9.0 requires MacOS-14 or later. However, this is an environment requirement, not a code-breaking change.

All breaking changes by upgrading torch from version 2.4.0 to 2.13.0 (CHANGELOG)

Version	Description
2.10.0	Removed unused `data_source` argument from Sampler. Custom samplers using this argument must be updated accordingly.
2.10.0	Removed deprecated imports for `torch.utils.data.datapipes.iter.grouping`. Users must import `SHARDING_PRIORITIES` and `ShardingFilterIterDataPipe` from `torch.utils.data.datapipes.iter.sharding` instead.
2.10.0	Removed Nested Jagged Tensor support from `nn.attention.flex_attention`.
2.10.0	`fallback=False` is now the default in `torch.onnx.export`. The exporter now uses `dynamo=True` option without fallback. To preserve 2.9 behavior, manually set `fallback=True` in the `torch.onnx.export` call.
2.10.0	Renamed pytorch-triton package to triton.
2.11.0	Volta (SM 7.0) GPU support removed from CUDA 12.8 and 12.9 binary builds
2.11.0	PyPI wheels now ship with CUDA 13.0 instead of CUDA 12.x; CUDA 13.0 only supports Turing (SM 7.5) and newer GPU architectures on Linux x86_64, dropping Maxwell and Pascal GPU support
2.11.0	`torch.hub.list()`, `torch.hub.load()`, and `torch.hub.help()` now default `trust_repo` parameter to `"check"` instead of `None`; the `trust_repo=None` option has been removed
2.11.0	`torch.nn.attention.varlen_attn` signature changed: optional arguments like `is_causal`, `return_aux`, and `scale` must now be passed as keyword arguments (keyword-only separator `*` inserted before optional arguments)
2.11.0	`is_causal` parameter removed from `torch.nn.attention.varlen_attn`; causal attention now expressed through `window_size` parameter
2.11.0	`DebugInfoWriter` now honors `$XDG_CACHE_HOME` for its cache directory in C++ code instead of always using `~/.cache/torch`
2.11.0	`DeviceMesh` now stores a process group registry directly; process groups must be initialized before constructing the DeviceMesh
2.11.0	`DTensor.to_local()` backward now converts `Partial` placements to `Replicate` by default when `grad_placements` is not provided
2.11.0	`_PhiloxState.seed` and `_PhiloxState.offset` now return `torch.Tensor` instead of `int`
2.11.0	caffe2 support fully removed from ROCm PyTorch's hipify preprocessing (hipify v2); downstream PyTorch extension projects that explicitly included Masquerading headers or called Masquerading APIs could experience failed builds
2.11.0	`torch.export.export_for_training` has been removed
2.11.0	`fallback` parameter removed from `torch.onnx.export()`
2.11.0	`custom_translation_table` parameter in `torch.onnx.export()` no longer accepts a list of functions for each torch op; changed from `dict[Callable, Callable \| Sequence[Callable]]` to `dict[Callable, Callable]`
2.11.0	PT2E quantization flow (`torch.ao.quantization.pt2e` and `torch.ao.quantization.quantizer`) removed from PyTorch and migrated to torchao
2.12.0	Strengthened SVE compile checks in `FindARM.cmake` may reject previously accepted but incorrect SVE configurations during CMake configuration.
2.12.0	Updated the minimum CUDA version required to build PyTorch from source to CUDA 12.6; CUDA versions older than 12.6 are no longer supported.
2.12.0	Enforced a C++20 minimum in CMake build files; source builds now require a compiler and build configuration that support C++20.
2.12.0	`torch.distributed.nn.functional` ops now raise `RuntimeError` under `torch.compile`; users must migrate to the functional collectives API in `torch.distributed._functional_collectives`.
2.12.0	`torchrun` now defaults to an OS-assigned free port for single-node training instead of port 29500 when running without specifying `--master-port` or `--standalone`.
2.12.0	All MPS tensors are now allocated in unified memory unconditionally; code that relied on device-only memory placement may observe different performance characteristics.
2.12.0	The `max_autotune` layout-constraint deferral introduced in 2.11 is now opt-in; users who relied on the deferred behavior for fusion opportunities must opt in explicitly via `torch._inductor.config.max_autotune_defer_layout_freezing` or environment variable.
2.13.0	Stop building CPython 3.13t (free-threaded) binaries. Users on the free-threaded interpreter must move to Python 3.14t.
2.13.0	Bare `PyObject` is no longer allowed in operator schemas. Schema strings with bare `PyObject` arguments or return types now raise a schema parse error.
2.13.0	Remove Bazel build support. All Bazel build files and CI jobs have been removed; users must migrate to the CMake/pip install build flow.
2.13.0	Enforce C++20 minimum in header guards. C++20 is now required to import PyTorch headers.
2.13.0	`StorageImpl`'s built-in copy-on-write (COW) materialization is replaced by a pluggable materializer hook. The internal COW entry points `StorageImpl::is_cow()`, `StorageImpl::maybe_materialize_cow()`, and `cow::materialize_cow_storage()` have been removed.
2.13.0	Convert `shared_ptr<Node>` to `intrusive_ptr<Node>`. This changes the signature of `Tensor::grad_fn` from `std::shared_ptr<Node>` to `c10::intrusive_ptr<Node>`.
2.13.0	The minimum supported NCCL version when building from source is now 2.23. Users building against older NCCL versions will hit compile errors.
2.13.0	Remove named tensors. All associated Python and C++ APIs have been removed, including `Tensor.names`, `Tensor.rename()`, `Tensor.refine_names()`, `Tensor.align_to()`, `Tensor.align_as()`, `torch.align_tensors()`, the `names=` keyword on factory functions, and C++ `Dimname`/`DimnameList` APIs.
2.13.0	The `onednn::qconv2d_pointwise.binary` and `.binary_tensor` operators no longer alias their input but return fresh tensors. Code relying on in-place mutation of the `qaccum` input must now read the returned tensor instead.
2.5.0	CPython 3.8 support has been removed from PyTorch binaries
2.5.0	`ProcessGroup.Options` removed from ProcessGroup initialization; users must now create ProcessGroup without passing base options and set default backend separately using `_set_default_backend`
2.5.0	`dynamic_dim()` method for specifying dynamic shapes in `torch.export()` has been removed; use `Dims` instead
2.5.0	Benchmarking path changed from `torch._inductor.runtime.runtime_utils.do_bench_gpu` to `torch._inductor.runtime.benchmarking.benchmarker.benchmark_gpu`
2.5.0	MacOS-12.3 specific checks deleted from MPS backend
2.5.0	Fully masked rows in `attn_mask` passed to `nn.functional.scaled_dot_product_attention` now yield 0s instead of NANs in output
2.5.0	Options to `torch.onnx.export` (except for the first three arguments) are now keyword-only
2.5.0	Deprecated internal API `torch.onnx._export` has been removed; use `torch.onnx.export` instead
2.5.0	The `op_level_debug` option from `torch.onnx.ExportOptions` has been removed
2.5.0	The `ONNXProgramSerializer` class has been removed
2.5.0	The `SymbolicContext` class has been removed; custom symbolic functions can no longer take `ctx: torch.onnx.SymbolicContext` as first argument
2.5.0	Support for caffe2 has been removed from ONNX export
2.5.0	`CheckerError` and `InvalidExportOptionsError` classes are removed
2.6.0	Default value of `weights_only` parameter in `torch.load` changed to `True`. Previously serialized objects beyond basic types will fail to load unless `weights_only=False` is explicitly specified.
2.6.0	PyTorch stopped publishing Anaconda packages that depend on Anaconda's default packages. Users must switch to official wheel packages from download.pytorch.org/PyPI or use conda-forge packages.
2.6.0	Linux binaries for CUDA 12.6.3, Linux aarch64 CPU/GPU, ROCm 6.2.4, and Linux XPU are built with CXX11_ABI=1 and Manylinux 2.28. Custom C++ or CUDA extensions must be updated to use CXX_ABI=1.
2.6.0	`torch.onnx.export(..., dynamo=True)` now creates ONNX models using IR version 10 instead of previous versions. Model consumers must support IR version 10.
2.6.0	Several obsolete ONNX APIs removed: logging APIs, `torch.onnx.ExportTypes`, and `torch.onnx.export_to_pretty_string`.
2.6.0	`torch.onnx.ONNXProgram` has been reimplemented with new methods (`save()`, `optimize()`). Some legacy methods are no longer available.
2.6.0	CUDA 12.1 support removed from CI/CD.
2.6.0	Stack allocation config renamed: `TORCHINDUCTOR_STACK_ALLOCATION` deprecated in favor of `torch.compile(options={"aot_inductor.allow_stack_allocation": True})`.
2.6.0	`torch._utils.is_compiling()` moved to `torch.compiler.is_compiling()`.
2.6.0	Stack allocation related configs in AOTI now require `aot_inductor` prefix: `use_minimal_arrayref_interface` and `allow_stack_allocation` options must be prefixed.
2.7.0	Dropped support for Triton < 2.2.0 (versions without ASTSource)
2.7.0	Removed CUDA 12.4 support in CI/CD in favor of 12.8
2.7.0	Removed Anaconda support in CI/CD
2.7.0	C++ Extensions with `py_limited_api=True` now built with `-DPy_LIMITED_API` flag, which may cause custom extensions that set this flag but don't abide by the limited API to fail to build
2.7.0	`torch.Tensor.new_tensor()` now creates tensors on the given Tensor's device by default instead of "cpu" device
2.7.0	Migration to manylinux_2_28 (AlmaLinux 8 based) and CXX11_ABI=1 for Linux wheel builds, no longer supporting OS distros with glibc2_26 including Amazon Linux 2 and CentOS 7
2.7.0	`torch.onnx.dynamo_export` now uses ExportedProgram logic path; `ExportOptions` fields `diagnostic_options`, `fake_context` and `onnx_registry` are removed/ignored, only `dynamic_shapes` is retained
2.7.0	Removed `LRScheduler.print_lr()` and the `verbose` kwarg to the LRScheduler constructor (deprecated since 2.2)
2.7.0	libtorch_python.so symbols are now invisible by default on all platforms except Apple; extensions using private symbols will see linker failures
2.7.0	`capture_pre_autograd_graph` deprecated in favor of `torch.export.export` for pytorch 2 export quantization
2.7.0	New interface for `torch.fx.passes.graph_transform_observer.GraphTransformObserver` to enable Node Level provenance tracking; `on_node_creation` and `on_node_erase` replaced with `get_node_creation_hook`, `get_node_erase_hook`, `get_node_replace_hook` and `get_deepcopy_hook`
2.7.0	`torch.ao.quantization.pt2e.graph_utils.get_control_flow_submodules` is no longer public; must use `_get_control_flow_submodules` for private access
2.8.0	Removed support for Maxwell and Pascal architectures (sm50-sm60) with CUDA 12.8 and 12.9 builds due to binary size limitations. Users needing these architectures must use CUDA 12.6 instead.
2.8.0	Calling an op with an unsupported input dtype now raises `NotImplementedError` instead of `RuntimeError`. Exception handling logic must be updated accordingly.
2.8.0	Custom `autograd.Function` now properly raises an error when mutating a view of a leaf requiring grad (previously silently leaked memory).
2.8.0	The out variant of `tensordot` now properly throws an error when called with a `requires_grad=True` tensor (previously did not error but could not compute gradients).
2.8.0	Specialization of a tensor shape with `mark_dynamic` applied now correctly errors in certain cases. Workaround is to use `maybe_mark_dynamic` instead of `mark_dynamic`.
2.8.0	Several torch.compile config variables have been renamed or removed: `enable_cpp_framelocals_guard_eval` no longer has effect, `rocm.n_max_profiling_configs` deprecated, `autotune_fallback_to_aten` deprecated, `use_mixed_mm` and `mixed_mm_choice` deprecated, `descriptive_names = False` deprecated, `custom_op_default_layout_constraint` moved from inductor to functorch config, `emit_current_arch_binary` deprecated, `aot_inductor.embed_cubin` renamed to `aot_inductor.embed_kernel_binary`, and `aot_inductor.compile_wrapper_with_O0` renamed to `compile_wrapper_opt_level`.
2.8.0	Added stricter aliasing/mutation check for `HigherOrderOperator`s (e.g. `cond`), which explicitly errors out if alias/mutation among inputs and outputs is unsupported. Affected code must add `.clone()` to aliased outputs.
2.8.0	`definitely_true` / `definitely_false` APIs have been removed and replaced with `guard_or_true` / `guard_or_false`.
2.8.0	`torch.export.export_for_inference` has been removed in favor of `torch.export.export_for_training().run_decompositions()`.
2.8.0	Default changed to `strict=False` in `torch.export.export` and `export_for_training` (previously `strict=True`). To revert to old behavior, explicitly pass `strict=True`.
2.8.0	Default ONNX opset version in `torch.onnx.export` (when `dynamo=False`) updated from 17 to 18. Users can set `opset_version` explicitly to select a different version.
2.8.0	`JitTraceConvertStrategy` has been removed. Support for JIT traced and scripted modules in ONNX exporter when `dynamo=True` has been removed.
2.8.0	`onnxscript>=0.3.1` is now required for the `dynamo=True` option in ONNX export.
2.8.0	Removed the `torch/types.h` include from `Dispatcher.h`, which can cause build errors in C++ code that implicitly relies on this include.
2.8.0	Upgraded `DLPack` to 1.0, renaming some `DLDeviceType` enum values (e.g., `kDLGPU` to `kDLCUDA`, `kDLCPUPinned` to `kDLCUDAHost`).
2.8.0	NVTX3 code moved from `cmake/public/cuda.cmake` to `cmake/Dependencies.cmake`. Downstream projects that previously got NVTX3 through `cmake/public/cuda.cmake` must now explicitly configure NVTX3 support using `USE_SYSTEM_NVTX=1`.
2.8.0	Windows wheel builds with CUDA 12.9.1 do not include `torch.segment_reduce()` due to a CUDA bug causing build crashes. Users needing this function must use a different CUDA version.
2.9.0	Minimum supported Python version increased from 3.9 to 3.10
2.9.0	Custom operators that return Tensors sharing storage with input tensors may now return silently incorrect results under `torch.compile` (previously undefined behavior)
2.9.0	PyTorch MPS backend now requires MacOS-14 or later (removed support for MacOS-13 and earlier)
2.9.0	Upgraded to DLPack 1.0 with breaking changes to objects in `torch.utils.dlpack` (e.g., `DLDeviceType`)
2.9.0	`torch.cat` now raises `ValueError`, `IndexError` or `TypeError` instead of generic `RuntimeError` where appropriate
2.9.0	ONNX exporter now defaults to `dynamo=True` (uses `torch.export.export` pipeline instead of legacy TorchScript exporter)
2.9.0	Export now switches off runtime asserts by default; `exported_program.module()` generates a `_guards_fn` submodule call for input checks (can be disabled with `check_guards=False`)
2.9.0	ONNX exporter default opset changed from 18 to 20
2.9.0	`torch.export.draft_export` is no longer auto-invoked on export failures; must opt-in via `TORCH_ONNX_ENABLE_DRAFT_EXPORT=True` environment variable
2.9.0	Removed `torch.onnx.dynamo_export` (use `torch.onnx.export` instead)
2.9.0	Removed experimental ONNX Runtime compile backend (`torch.compile(backend="onnxrt")`)
2.9.0	Removed `torch.onnx.enable_fake_mode`
2.9.0	Public facing ONNX utility APIs for TorchScript-based exporter are now private; deprecated members in `torch.onnx.verification` removed; `torch.onnx.symbolic_opsets*` functions no longer accessible
2.9.0	Removed `torch.onnx.symbolic_caffe2`
2.9.0	Re-introduced AVX512 optimizations for Windows VS2022 builds (removed `/d2implyavx512upperregs` flag), may cause issues with specific VS2022 versions
2.9.0	Added `ScalarType` to shim conversion; narrowly breaking for unpopular dtypes (`quint`, `qint`, `Bits`, `dummy_uint`, `dummy_int*`, `Float8_e8m0fnu`, `Float4_e2m1fn_x2`) when retrieving Tensor dtype and passing to `aoti_torch_call_dispatcher`

✅ 8 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-32434	🚨 CRITICAL	[torch] A Remote Code Execution vulnerability exists when loading models with torch.load and weights_only=True, allowing attackers to execute arbitrary commands during model deserialization.
AIKIDO-2025-10060	HIGH	[torch] Insecure pickle handling with `weights_only=False` allows arbitrary code execution when loading malicious pickle files, enabling remote code execution (RCE) attacks.
CVE-2025-3730	MEDIUM	[torch] The ctc_loss function in torch.nn.functional is vulnerable to denial of service through malicious input manipulation. This local attack vector can crash the application when processing untrusted models or data.
CVE-2025-2953	MEDIUM	[torch] A denial of service vulnerability exists in the torch.mkldnn_max_pool2d function that can be exploited locally through malicious models. The vulnerability allows attackers to cause application crashes or resource exhaustion.
AIKIDO-2026-636203	MEDIUM	[torch] A bundled outdated `libuv` library truncates hostnames longer than 256 characters before DNS resolution, allowing crafted long hostnames to resolve to unintended addresses and enabling server-side request forgery attacks. The vulnerability affects distributed C++ binaries when resolving externally influenced hostnames.
CVE-2025-2999	MEDIUM	[torch] A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVE-2025-3000	MEDIUM	[torch] A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVE-2025-3001	MEDIUM	[torch] A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

fix(security): update torch from 2.4.0 to 2.13.0

9709bce

Navigation Menu

Repository navigation

[Aikido] Fix security issue in torch via minor version upgrade from 2.4.0 to 2.13.0 - #2

[Aikido] Fix security issue in torch via minor version upgrade from 2.4.0 to 2.13.0#2
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-141362048-7f83

aikido-autofix Bot commented Oct 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

aikido-autofix Bot commented Oct 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants