CVE-2026-113743

Name of the Vulnerable Software and Affected Versions Tenstorrent tt-metal versions prior to 0.81.0-dev20261016

Description A path traversal issue exists in the load hf state dict filtered() function within the models/tt transformers/tt/load checkpoints.py file. This occurs when the weight map argument is manipulated, allowing a remote attacker to potentially access or traverse unauthorized directories.

Recommendations Upgrade to version 0.81.0-dev20261016. As a temporary mitigation, restrict the use of the load hf state dict filtered() function.