Remote Command Execution

scio-pypi is vulnerable to Remote Command Execution. The vulnerability is due to torch.load executing unsafe deserialization even when weightsonly=True, which allows an attacker to craft malicious model files that trigger arbitrary code execution during loading...

scio is vunerable to Remote Command Execution through PyTorch

Impact PyTorch reported a critical vulnerability when using torch.load, even with option weightsonly=True, for torch = 2.6, starting from scio = 1.0.1 currently in dev state. Workarounds You can manually check that you are using torch = 2.6...

EUVD-2025-33343

scio is vunerable to Remote Command Execution through PyTorch...

GHSA-M9MP-6X32-5RHG scio is vunerable to Remote Command Execution through PyTorch

Impact PyTorch reported a critical vulnerability when using torch.load, even with option weightsonly=True, for torch = 2.6, starting from scio = 1.0.1 currently in dev state. Workarounds You can manually check that you are using torch = 2.6...

PT-2025-42721

Impact PyTorch reported a critical vulnerability when using torch.load, even with option weights only=True, for torch = 2.6, starting from scio = 1.0.1 currently in dev state. Workarounds You can manually check that you are using torch = 2.6...

com.ericsson.bss.cassandra.ecaudit:ecaudit_c2.2 (>=2.3.0, <=2.6.0), com.spotify:scio-cassandra2_2.11 (>=0.8.2, <=0.8.4) +1 more potentially affected by CVE-2025-23015 via org.apache.cassandra:cassandra-all (2.2.16)

org.apache.cassandra:cassandra-all MAVEN version 2.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.ericsson.bss.cassandra.ecaudit:ecauditc2.2 =2.3.0, =0.8.2, =0.8.2, =0.8.4 Source cves:...

com.spotify:scio-elasticsearch6_2.12 (>=0.10.3, <=0.10.4), com.spotify:scio-elasticsearch6_2.13 (>=0.10.3, <=0.10.4) +6 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.8.16)

org.elasticsearch:elasticsearch MAVEN version 6.8.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.spotify:scio-elasticsearch62.12 =0.10.3, =0.10.3, =0.10.4 - io.gitee.johnpeng:mx-dal-elastic...

com.spotify:scio-elasticsearch6_2.12 (0.9.3), com.spotify:scio-elasticsearch6_2.13 (0.9.3) +6 more potentially affected by CVE-2024-23444 via org.elasticsearch:elasticsearch (6.8.11)

org.elasticsearch:elasticsearch MAVEN version 6.8.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.spotify:scio-elasticsearch62.12 0.9.3 - com.spotify:scio-elasticsearch62.13 0.9.3 -...

com.spotify:scio-elasticsearch6_2.12 (0.11.2), com.spotify:scio-elasticsearch6_2.13 (0.11.2) +8 more potentially affected by CVE-2024-23444 via org.elasticsearch:elasticsearch (6.8.22)

org.elasticsearch:elasticsearch MAVEN version 6.8.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.spotify:scio-elasticsearch62.12 0.11.2 - com.spotify:scio-elasticsearch62.13 0.11.2 -...

com.spotify:scio-elasticsearch6_2.12 (>=0.10.3, <=0.10.4), com.spotify:scio-elasticsearch6_2.13 (>=0.10.3, <=0.10.4) +6 more potentially affected by CVE-2023-31418 via org.elasticsearch:elasticsearch (6.8.16)

org.elasticsearch:elasticsearch MAVEN version 6.8.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.spotify:scio-elasticsearch62.12 =0.10.3, =0.10.3, =0.10.4 - io.gitee.johnpeng:mx-dal-elastic...

at.molindo:esi4j (>=3.0.0, <=3.0.2), at.molindo:scrutineer (3.0.0) +9 more potentially affected by CVE-2022-24913 via com.fasterxml.util:java-merge-sort (>=1.0.0, <=1.0.2)

com.fasterxml.util:java-merge-sort MAVEN version =1.0.0, =3.0.0, =6.5.0, =2.3.0, =0.5.3, =0.5.3, =0.9.0, =0.5.3, =0.5.3, =0.9.0, =1.0.2, =1.0.4 Source cves: CVE-2022-24913 Source advisory: SNYK:JAVA-COMFASTERXMLUTIL-3227926...

com.spotify:scio-cassandra2_2.11 (>=0.6.0, <=0.7.0-beta1), com.spotify:scio-cassandra2_2.12 (>=0.6.0, <=0.7.0-beta1) +1 more potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (2.2.12)

org.apache.cassandra:cassandra-all MAVEN version 2.2.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.spotify:scio-cassandra22.11 =0.6.0, =0.6.0, =1.2.2, =2.0 Source cves: CVE-2021-44521...

com.spotify:scio-cassandra2_2.11 (>=0.8.0, <=0.8.1), com.spotify:scio-cassandra2_2.12 (>=0.8.0, <=0.8.1) potentially affected by CVE-2021-44521 via org.apache.cassandra:cassandra-all (2.2.15)

org.apache.cassandra:cassandra-all MAVEN version 2.2.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cassandra:cassandra-all and may be impacted: - com.spotify:scio-cassandra22.11 =0.8.0, =0.8.0, =0.8.1 Source cves: CVE-2021-44521 Source...

Android Also Gives Google Remote App Installation Power

The remote-wipe capability that Google recently invoked to remove a harmless application from some Android phones isn’t the only remote control feature that the company built into its mobile OS. It turns out that Android also includes a feature that enables Google to remotely install apps on user...