ZDI-26-952: (0Day) Meta FAIRChem _cli YAML File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Meta FAIRChem's _cli component due to unsafe YAML file parsing and deserialization of untrusted data. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity rating assigned by the Zero Day Initiative.

• zerodayinitiative.com/advisories/ZDI-26-952/ (opens in a new tab)

• ZDI-26-947: (0Day) Meta FAIRChem make_submission_file NPZ File Parsing Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-948: (0Day) Meta FAIRChem MLIPPredictUnit Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-949: (0Day) Meta FAIRChem utils load_model_and_weights_from_checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-950: (0Day) Meta FAIRChem migrate_checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-11
• ZDI-26-951: (0Day) Meta FAIRChem utils load_tasks Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-11-11