gridfm / gridfm/gridfm-graphkit

Re-enable pip-audit checks for torch CVEs once 2.9.0 is adopted

Open
#74 0 comments 0 reactions 1 assignee View on GitHub

@romeokienzler is already working on this.

Since Jun 9, 2026.

Dominant language
Python
Stars
105
Forks
36
Avg merge
1d 8h
Merged PRs (30d)
9

Description

The CI pip_audit job currently ignores the following vulnerabilities in .github/workflows/ci-build.yaml:

  • PYSEC-2025-203 — torch 2.8.0 torch.linalg.lu slice DoS (fixed in 2.9.0)
  • PYSEC-2025-204 — torch 2.8.0 rot90 + randn_like interaction (fixed in 2.9.0)
  • PYSEC-2025-206 — torch 2.8.0 nan_to_num().long() integer overflow (fixed in 2.9.0)
  • PYSEC-2026-139 — torch pt2 loading handler deserialization (no fix released yet)

Action items

  • When torch is bumped to >=2.9.0, remove PYSEC-2025-203, PYSEC-2025-204, PYSEC-2025-206 from the ignore-vulns list.
  • Periodically recheck upstream for a fix to PYSEC-2026-139 and remove it once a patched torch release is available.
  • Audit torch.load / pt2 load sites and add weights_only=True (or equivalent) where checkpoints could come from untrusted sources, since PYSEC-2026-139 will remain unpatched for a while.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.