Description

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-20T23:17:03.343Z",
  "pubdate": "2026-09-20T23:17:03.343Z",
  "executiveSummary": "DLR-RM stable-baselines3, in versions up to 2.9.0, contains a critical vulnerability involving insecure deserialization of serialized objects. The vulnerability stems from the use of pickle-based loading mechanisms within core API functions such as PPO.load, load_replay_buffer, and VecNormalize.load located in save_util.py.\nThis flaw allows a remote attacker to execute arbitrary code by supplying a maliciously crafted model or buffer file. The vulnerability persists because the library relies on unsafe deserialization methods, and previous attempts to implement security hardening via PyTorch's weights_only=True parameter have been inconsistent or reverted due to compatibility constraints. Consequently, the application lacks a secure, gated loading path for untrusted data. The risk to affected systems is severe, as successful exploitation enables full system compromise, remote code execution (RCE), and complete control over the application environment. Given the public disclosure of the exploit vector, users are at high risk if they interact with model files from unverified or untrusted sources.",
  "technicalDetails": "The vulnerability resides within the deserialization logic of save_util.py in the stable-baselines3 library. The core APIs, including PPO.load(), load_replay_buffer(), and VecNormalize.load(), utilize Python’s pickle module to reconstruct object states from saved binary files. The pickle module is inherently insecure when processing data from untrusted sources, as it can be leveraged to execute arbitrary Python code during the object reconstruction process via the __reduce__ method.\nThe attack flow initiates when an attacker provides a maliciously serialized model file to a target instance of stable-baselines3. When the application invokes the vulnerable load functions, the underlying pickle deserialization triggers the execution of the embedded payload. Because the library does not implement strict input validation or sandboxing of the data stream prior to deserialization, the malicious code executes with the same privileges as the user process running the model loader.\nEfforts to mitigate this threat have been largely unsuccessful or incomplete. While an attempt was made in v2.9.0 to utilize PyTorch's weights_only=True hardening, this was subsequently reverted via PR #1913 to address PyTorch 1.13 compatibility issues, rendering the safeguard ineffective. Furthermore, previous remediation efforts (such as those in #1831) focused exclusively on the huggingface_sb3 integration, leaving the core stable-baselines3 library exposed. The absence of a consistent secure loading mechanism means that all versions, including 2.9.0, remain vulnerable to remote exploitation. The exploit vector is considered public, making the system susceptible to automated attacks if the application accepts input files from remote networks or external users. Post-exploitation, an attacker can gain persistent access, exfiltrate local data, or pivot into the internal network environment where the model is being deployed, depending on the environment's access control configurations."
}