[https://nvbugs/6025330][fix] Use weights_only=True in LoRA manager torch.load

[yibinl-nvidia]

The LoRA weight loading path in lora_manager.py used torch.load() without weights_only=True, allowing arbitrary code execution via malicious pickle payloads in LoRA adapter archives. This is a runtime serving path where the LoRA path can be user-controlled via API requests.

Addresses NVBugs 6025330.

Summary by CodeRabbit

• Bug Fixes
  • Improved security when loading NeMo model weights—now uses stricter deserialization to load only weight data from checkpoint files, preventing potential loading of unintended objects.

Description

Test Coverage

PR Checklist

Please review the following before submitting your PR:

• PR description clearly explains what and why. If using CodeRabbit's summary, please make sure it makes sense.

• PR Follows TRT-LLM CODING GUIDELINES to the best of your knowledge.

• Test cases are provided for new code paths (see test instructions)

• Any new dependencies have been scanned for license and vulnerabilities

• CODEOWNERS updated if ownership changes

• Documentation updated as needed

• Update tava architecture diagram if there is a significant design change in PR.

• The reviewers assigned automatically/manually are appropriate for the PR.

• Please check this after reviewing the above items as appropriate for this PR.

GitHub Bot Help

To see a list of available CI bot commands, please comment /bot help.

[yibinl-nvidia]

/bot run

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 76b1a1e7-e936-42ad-9d69-ac028c66698b

📥 Commits

Reviewing files that changed from the base of the PR and between a492e5b and 4f27dc4.

📒 Files selected for processing (1)

• tensorrt_llm/lora_manager.py

---

📝 Walkthrough

Walkthrough

A single modification to the unpack_nemo_weights function in the LoRA manager that adds the weights_only=True parameter to torch.load, restricting deserialization to weights only from NeMo checkpoint files instead of arbitrary pickled objects.

Changes

Cohort / File(s)	Summary
Weight Loading Security tensorrt_llm/lora_manager.py	Modified torch.load call to include weights_only=True parameter, restricting deserialization to tensor objects only when loading NeMo model weights.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: adding weights_only=True to torch.load in the LoRA manager to address a security vulnerability.
Description check	✅ Passed	The PR description explains the security issue and solution, references the bug ticket, and the author checked the PR checklist; however, the Description, Test Coverage, and Docstrings sections remain unfilled.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[tensorrt-cicd]

PR_Github #45226 [ run ] triggered by Bot. Commit: 4f27dc4 Link to invocation

[tensorrt-cicd]

PR_Github #45226 [ run ] completed with state SUCCESS. Commit: 4f27dc4
/LLM/main/L0_MergeRequest_PR pipeline #35489 completed with status: 'SUCCESS'

CI Report

Link to invocation

[venkywonka]

thank you for catching that! lgtm!