The GitHub Actions job "tvm-bot" on tvm.git/main has failed. Run started by GitHub user yongwww (triggered by yongwww).
Head commit for run: 7b3fa38e6b76564dabe5d6b09023a566a1520c27 / scruge1 <[email protected]> fix: add safety warning to pickle_memoize cache loading (#18925) ## Summary `pickle_memoize` loads cached pickle files via `pickle.load()` without any integrity verification or user warning. If an attacker can write to the cache directory, they can inject malicious pickle payloads that execute arbitrary code on next load. ## Fix Adds a `UserWarning` when loading pickle cache files to alert users about the security risk. ## Related Huntr security vulnerability report (CWE-502: Deserialization of Untrusted Data) Signed-off-by: scruge1 <[email protected]> Co-authored-by: scruge1 <[email protected]> Report URL: https://github.com/apache/tvm/actions/runs/23492955047 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
