2540 matches found
CVE-2024-10190 Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandler. Specifically, the putvalue method in ElasticRendezvousHandler...
CVE-2024-10190 Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandler. Specifically, the putvalue method in ElasticRendezvousHandler...
mmdetection 代码问题漏洞
mmdetection is an OpenMMLab open source OpenMMLab inspection toolkit and benchmark test. A code issue vulnerability exists in mmdetection version v3.3.0, which stems from improper use of the pickle.loads function and could lead to remote code execution...
PT-2025-12291
Name of the Vulnerable Software and Affected Versions Kedro version 0.19.8 Description A Remote Code Execution RCE issue has been identified, allowing an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The...
PT-2025-12261
Name of the Vulnerable Software and Affected Versions vllm-project vllm version 0.6.0 Description The issue concerns a remote code execution vulnerability in the distributed training API. Specifically, the vllm.distributed.GroupCoordinator.recv object function deserializes received object bytes...
PT-2025-12024
Name of the Vulnerable Software and Affected Versions Dask versions =2024.8.2 Description The issue concerns a vulnerability in the Dask Distributed Server. It allows attackers to craft malicious objects using pickle serialization. These objects can be serialized on the client side and sent to th...
CVE-2024-11039: Deserialization of Untrusted Data
A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gptacademic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the...
PT-2025-12093
Name of the Vulnerable Software and Affected Versions vllm-project vllm version v0.6.2 Description The issue is related to a remote code execution vulnerability in the MessageQueue.dequeue API function. This function uses pickle.loads to parse received sockets directly, allowing an attacker to...
CVE-2024-12433: Deserialization of Untrusted Data
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the serve...
RAGFlow 代码问题漏洞
RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A code issue vulnerability exists in RAGFlow version v0.12.0, which stems from hard-coded AuthKey and pickle deserialization and could lead to remote code execution...
CVE-2024-9701: Deserialization of Untrusted Data
A Remote Code Execution RCE vulnerability has been identified in the Kedro ShelveStore class version 0.19.8. This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class use...
Arbitrary Code Execution (ACE)
PickleScan is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to PickleScan failing to detect malicious pickle files when specific ZIP file flag bits are modified, allowing attackers to embed harmful pickle files that remain unnoticed while still being loaded by PyTorch’s...
Deserialization of Untrusted Data
Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the loadmodel function, which uses pickle for serialization. An attacker can execute code even if safemode is set to True, by supplyi...
Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
Summary PickleScan fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully...
GHSA-W8JQ-XCQF-F792 Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
Summary PickleScan fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully...
Remote Code Execution (RCE)
DGL is vulnerable to Remote Code Execution RCE.The vulnerability is due to unsafe deserialization due to the use of Python's pickle module for serializing and deserializing network messages, which can allow attackers to execute arbitrary code remotely...
Insufficient Verification of Data Authenticity
Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to improper handling of modified ZIP file flag bits. Attackers can exploit this by altering...