Fixes go into the latest 2.x release.

Please do not open a public issue. Use GitHub's private reporting: the Security tab of the repository, then Report a vulnerability (https://github.com/EDF-Lab/GEARS/security/advisories/new). Say which version you use, what you did, and what happened. A maintainer will answer there.

GEARS saves a fitted model with joblib, which is pickle: opening a model file can run arbitrary code.

• load_pretrained(model_id) downloads a published model and checks its SHA-256 against the value in gears/pretrained.py before opening it (no model is published with 2.0.0). The same check applies when you pass path=. Once models are published, the checksum of each release file is also in SHA256SUMS on the release page.
• EVSessionModel.load(path) and GEARSModel.load(path) open the file you give them without any check. Open only files you saved yourself or got from a source you trust, and compare their sha256sum with the published one.
• import gears does not touch the network or the disk. The only download is load_pretrained, and GEARS_OFFLINE=1 forbids it.

GEARS ships no data.