CVE-2026-31218 describes an insecure deserialization vulnerability in the _load_model() function of the optimate project. The function loads a model state dictionary from a state_dict.pt file using torch.load() but does not enable the weights_only=True parameter, which is intended to restrict deserialization to tensor weights only. Because torch.load() uses Python's Pickle module internally, this omission allows an attacker to craft a malicious state_dict.pt file that can execute arbitrary Python code during deserialization. The attack vector involves specifying a directory containing the malicious file via the --model argument, leading to code execution on the victim's system.

Successful exploitation results in arbitrary code execution on the victim's system during model loading. This can lead to full system compromise depending on the privileges of the process running the script. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid loading untrusted or unauthenticated state_dict.pt files. Applying the weights_only=True parameter in torch.load() calls is recommended to mitigate this vulnerability once a patch or update is released.