CVE-2025-50472

The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the "loadmodelmeta" function of the "ModelFileSystemCache" class. Attackers can execute arbitrary code and commands by crafting a malicious serialized ".mdl"...

CVE-2025-50472: Deserialization of Untrusted Data

The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadmodelmeta function of the ModelFileSystemCache class. Attackers can execute arbitrary code and commands by crafting a malicious serialized .mdl payload,...