`RCE via unsafe deserialization in Model Maker (torch.load, Keras, tar slip, yaml.FullLoader)`

### Have I written custom code (as opposed to using a stock example script provided in MediaPipe) No ### OS Platform and Distribution Linux Ubuntu 22.04 ### Mobile device if the issue happens on mobile device _No response_ ### Browser and version if the issue happens on browser _No response_ ### Programming Language and version `Python 3.11.15` ### MediaPipe version 0.10.x ### Bazel version _No response_ ### Solution Model maker ### Android Studio, NDK, SDK versions (if issue is related to building in Android environment) _No response_ ### Xcode & Tulsi version (if issue is related to building for iOS) _No response_ ### Describe the actual behavior `torch.load deserializes __reduce__ payloads; Keras Lambda executes code; tar slip overwrites cache; yaml.FullLoader runs Popen. RCE confirmed in attached evidence. ### Describe the expected behaviour `No arbitrary code execution from untrusted models/datasets. Use weights_only=True, safe_load, filter='data', separate arch/weights.` ### Standalone code/steps you may have used to try to get what you need See attached poc_model_maker.py — runs without MediaPipe install, hits exact vuln paths: file_util.py:77 → tarfile.extractall(tmpdir) # tar slip cache_files.py:106 → yaml.load(f, FullLoader) # YAML RCE + Attached evidence/*.txt for torch/Keras confirmations. ### Other info / Complete Logs ```shell ### Bug Description MediaPipe Model Maker has 4 deserialization RCEs via malicious models/datasets. PoCs attached. 1. pytorch_converter.py:36 torch.load(weights_only=False) → __reduce__ RCE 2. model_util.py:71 tf.keras.load_model() → Lambda RCE (safe_mode fails) 3. file_util.py:77 tarfile.extractall(no filter) → tar slip to cache 4. cache_files.py:106 yaml.load(FullLoader) → Popen gadgets **Repro/Impact**: See attached evidence/*.txt, poc_model_maker.py. Exploits via HF checkpoints/shared datasets. **Proposed Fixes**: - torch.load(..., weights_only=True) - Separate Keras arch/weights load - tarfile.filter='data' - yaml.safe_load() **Env**: Python 3.11+, TF 2.14, PyTorch 2.x, MediaPipe [your version] **Security**: Reported to Google OSS VRP; needs merged patch. ```