Security: unsafe YAML config loading enables arbitrary code execution (CWE-502)

[Ano1X8]

Describe the bug:

Loading a model configuration file in D-FINE can execute arbitrary code. src/core/yaml_utils.py::load_config()
parses the config with yaml.load(f, Loader=yaml.Loader) (the unsafe full loader; also used in the recursive
include branch and in parse_cli). yaml.Loader constructs arbitrary Python objects from YAML tags, so a
config containing a tag such as !!python/object/apply:os.system runs shell commands at parse time — before
any training or weight loading. This is a classic deserialization-of-untrusted-data issue (CWE-502).

I'm posting a minimal description publicly because the flaw is already visible in the source, so this gives an
attacker no real advantage; but I'm holding back a packaged model bundle / full PoC. Private Vulnerability

Reporting isn't enabled on this repo; if you enable it, or share an email, I'll send the
complete writeup and reproduction.

To Reproduce

Steps to reproduce the behavior:

1. Create a config file evil.yml whose contents include a malicious YAML tag, e.g.
   !!python/object/apply:os.system ["id > /tmp/pwned"]
   (in a real attack this is embedded in an otherwise-normal D-FINE config distributed with a checkpoint).
2. Run the documented workflow that a user would run on a downloaded model:
   python train.py -c evil.yml -r
   This calls YAMLConfig(args.config) -> load_config(), which parses the file with yaml.load(Loader=yaml.Loader).
3. Observe that the command executed at parse time (e.g. /tmp/pwned now exists), before training starts.
4. Result: arbitrary code execution from merely loading an attacker-supplied config.

Expected behavior

Loading a configuration file should only read data, it must never construct arbitrary Python objects or execute
code. The parser should deserialize safely so that a malicious config cannot run commands.

Screenshots

Omitted intentionally. A screenshot of the exploit executing would effectively publish the PoC; I'll include it
in the private writeup. Happy to provide on request through a private channel.

Desktop

• OS: platform-independent (reproduced on Linux; applies equally to macOS/Windows — this is a Python/PyYAML issue, not OS-specific)
• Browser: N/A (not a web/UI bug)
• Version: D-FINE master (all versions); Python 3.x with PyYAML

Additional context

Suggested fix (one line): replace Loader=yaml.Loader with Loader=yaml.SafeLoader at each of the three call
sites in src/core/yaml_utils.py. D-FINE configs use only plain mappings/lists/scalars, so SafeLoader is a drop-in
with no functional change.

Severity

CVSS 3.1 8.4
(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). I've requested a CVE ID (coordinated disclosure).

The same config-loader pattern appears across the RT-DETR lineage (RT-DETR, DEIM/DEIMv2, etc.); each project is
being reported separately. Thanks for D-FINE!