Security: BaseModel.load uses torch.load without weights_only, enabling RCE on torch<2.6

[shaun0927]

1. System Info

• PyPOTS: main @ 35cc268 (latest)
• Environment-independent (loader-side issue)

2. Information

• The official example scripts
• My own created scripts

3. Reproduction

pypots/base.py:384 loads a saved model with plain torch.load:

PyPOTS/pypots/base.py

Lines 383 to 384 in 35cc268

	map_location = self.device[0] if isinstance(self.device, list) else self.device
	loaded_file = torch.load(path, map_location=map_location)

map_location = self.device[0] if isinstance(self.device, list) else self.device
loaded_file = torch.load(path, map_location=map_location)

weights_only is not passed, so the behavior depends on the installed PyTorch version:

torch version	default weights_only	behavior when loading a crafted .pypots file
1.10 – 2.5	False	unpickles arbitrary Python objects → RCE via __reduce__
2.6+	True	legitimate pypots model files fail to load (safe-mode refuses the pickled dict)

Minimal PoC (run against a file produced with torch.save):

import os, pathlib, tempfile, torch

marker = pathlib.Path(tempfile.gettempdir()) / "pwned.txt"

class RCE:
    def __reduce__(self):
        return (os.system, (f"echo PWNED > {marker}",))

payload = {"model_state_dict": {"x": torch.tensor([1.0])}, "boom": RCE()}
torch.save(payload, "evil.pt")

# Reproduces the torch<2.6 default behavior that PyPOTS currently inherits.
torch.load("evil.pt", weights_only=False)
print(marker.read_text())  # -> PWNED

PyPOTS's existing requirements/requirements.txt pin is torch>=1.10, so
both branches of the table above apply to real users today.

4. Expected behavior

Explicitly set weights_only=True by default in BaseModel.load(). Provide
an opt-in (e.g. load(..., allow_untrusted=True)) that logs a warning and
falls back to the unsafe loader only when the caller knowingly asks for it.
That way:

• torch<2.6 users stop silently executing arbitrary code on load.
• torch>=2.6 users stop getting confusing safe-mode failures; the project
  chooses the boundary instead of deferring to torch defaults.

Happy to open a follow-up PR with the code change + a regression test once
you confirm the preferred shape of the opt-in kwarg (or if you'd rather
bump torch>=2.6 and drop the legacy branch entirely).

[github-actions]

Hi there 👋,

Thank you so much for your attention to PyPOTS! You can follow me on GitHub to receive the latest news of PyPOTS.
If you find PyPOTS helpful to your work, please star⭐️ this repository to get this issue prioritized.
Your star is your recognition, which can help more people notice PyPOTS and grow PyPOTS community.
It matters and is definitely a kind of contribution to the community.

Best,
Wenjie

[shaun0927]

Opened a focused fix for this in #841.

It makes BaseModel.load() pass weights_only=True when the active PyTorch runtime supports that safer path, while keeping the public load API unchanged and adding a regression test around the load contract.