NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access

A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library exposes remote code execution with root privileges, tracked as CVE-2025-23298 and disclosed by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team. The flaw arises from unsafe deserialization in the load_model_trainer_states_from_checkpoint function, where PyTorch’s torch[.]load() is used without sandboxing or class restrictions, allowing arbitrary code execution during checkpoint restoration.

ZDI confirmed that loading a crafted checkpoint could trigger root-level commands immediately when restoring model state, with the attack demonstrated by a malicious checkpoint object whose reduce method invokes system commands. NVIDIA patched the issue in Transformers4Rec commit b7eaea5 (PR #802), replacing direct pickle calls with a custom loader that validates object types before restoration.

The guidance urges avoiding untrusted pickle data and adopting safer formats such as safetensors or ONNX, while organisations should enforce model provenance checks, sign checkpoints cryptographically, and sandbox model loading to prevent full system compromise in production environments. According to gbhackers, the article was published on 25 September 2025.