[Security] Request contact info to report multiple vulnerabilities (deserialization/SSRF/RCE, etc.)

Nobody has claimed this yet.

@lllyasviel , hello.

During my usage/audit of this project, I discovered several security-related issues:

YAML deserialization vulnerability (yaml.load can lead to arbitrary code execution)

Torch model deserialization vulnerability (torch.load can lead to RCE)

SSRF / arbitrary URL request vulnerability (urlopen without validation can access internal resources)

Pickle deserialization vulnerability (pickle.load can lead to RCE)

Since these vulnerability details should not be disclosed publicly, could you please provide a private contact method (e.g., email, temporary chat, or a private issue) so that I can send you the full details, exploit chains, and suggested fixes?

Thank you for your open source work. Looking forward to your reply.

No files or tests are named. Start by locating the reported yaml.load, torch.load, urlopen, and pickle.load call sites, then prepare the exploit details and suggested fixes for private disclosure; the immediate issue is complete when a secure contact channel is provided and the report is received.

Written by the indexing model from the issue text.