[BUG] unsafe unpickling in v2 beta code - reported by @hackchang

[fkiraly]

Security vulnerability reported by @hackchang on ptf v2 beta code:

_BasePtForecasterV2(ckpt_path=...) auto-loads sidecar config files (model_cfg.pkl / datamodule_cfg.pkl / metadata.pkl) from the checkpoint dir via pickle.
load (base/_base_pkg.py:89,108) unconditionally (torch-independent), so loading a shared checkpoint dir = code execution.
PoC attached (benign marker).
CWE-502, CVSS ~8.4. Fix: JSON / restrict-unpickle the sidecar configs.

[phoeenniixx]

I think this will be changed once we remove the usage cfgs and move to a more cleaner solution (which is yet to be decided 🙂 )

What do you think @fkiraly @hackchang?

[hackchang]

Thanks for the quick repro and the credit, @fkiraly — and @phoeenniixx, I fully agree
with your direction.

Removing the pickled sidecar cfgs and moving to a cleaner mechanism is the best fix:
eliminating the deserialization sink at the root is strictly better than guarding it.

A couple of concrete thoughts for the "cleaner solution":

• model_cfg / datamodule_cfg / metadata are essentially configuration
  (hyperparameters, shapes, column names), not arbitrary Python objects. Serializing them
  as JSON (or YAML via safe_load) removes the RCE entirely and, as a bonus, makes the
  checkpoint sidecars portable and human-inspectable. This is the ideal target for v2.

• If any field genuinely needs to carry a Python callable/object (e.g. a custom loss or
  transform), I'd keep those out of the auto-loaded-by-default path — either reconstruct
  them from a registry/import-path string, or gate that specific load behind an explicit
  trusted=True opt-in — rather than pickling the whole cfg. That keeps the common case
  safe with zero user configuration.

• On timing: if the affected v2-beta code is already on PyPI as a pre-release, a small
  interim stopgap (a restricted unpickler, or refusing to load the sidecars unless
  trusted=True) would protect current beta users until the redesign lands. If it's only on
  an unreleased branch, folding the fix straight into the redesign is perfectly fine.

Happy to help either way — I can open a PR for the JSON/safe serialization, or for the
interim restricted-unpickle guard, whichever fits your roadmap. And whenever a fix ships,
a GHSA on the repo would assign the CVE and notify downstream via pip-audit (credit
"hackchang" / @hackchang is appreciated — thanks again for tagging it).