Deserialization Vulnerability in MosaicML Composer Allows Remote Code Execution

CVE-2026-10043

What is CVE-2026-10043?

A vulnerability in MosaicML Composer enables remote attackers to execute arbitrary code by exploiting the deserialization of untrusted data. This flaw arises due to insufficient validation of user-supplied data during checkpoint parsing. Successful exploitation requires user interaction, as the target must visit a malicious page or open a compromised file, allowing attackers to execute code in the context of the affected process. For more detailed information, refer to the ZDI-26-384 advisory and the vendor advisory.

References