CVE-2025-50472

CVE-2025-50472 ModelScope Ms-Swift ModelFileSystemCache 反序列化不可信数据导致远程代码执行漏洞 RCE PoC 我上传了一个包含恶意 .mdl 文件的代码仓库至 ModelScope 用于测试。测试时可以直接使用。链接为： https://www.modelscope.cn/models/HaoFan2024/ms-swift-test-fanhao/files 该 .mdl 文件嵌入了恶意代码，但 ModelScope 上未显示安全警告。 PoC 代码： 设置环境 pip install ms-swift==2.6.1 pip...

CVE-2025-50472

The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadmodelmeta function of the ModelFileSystemCache class. Attackers can execute arbitrary code and commands by crafting a malicious serialized .mdl payload,...

CVE-2025-50472: Deserialization of Untrusted Data

The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadmodelmeta function of the ModelFileSystemCache class. Attackers can execute arbitrary code and commands by crafting a malicious serialized .mdl payload,...

CVE-2025-50472

The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the "loadmodelmeta" function of the "ModelFileSystemCache" class. Attackers can execute arbitrary code and commands by crafting a malicious serialized ".mdl"...

CVE-2025-50472

The modelscope/ms-swift library (versions