Unsafe Deserialization Vulnerability in docTR Product by Mindee

CVE-2026-112304

What is CVE-2026-112304?

The docTR product by Mindee, specifically versions up to 1.1.0, contains a vulnerability associated with unsafe deserialization in the load_pretrained_params() function. This flaw allows attackers to manipulate local or URL-supplied checkpoints, embedding malicious pickle payloads that can execute arbitrary Python code with the privileges of the loading process. Affected users of torch versions prior to 2.6 are urged to apply necessary mitigations to safeguard their systems against potential exploits.

References