MS SWIFT Deserialization RCE Vulnerability

This appears to be a security vulnerability report describing a remote code execution RCE exploit in the ms-swift framework through malicious pickle deserialization in adapter model files. The vulnerability allows arbitrary command execution when loading specially crafted adapter models from...

PT-2025-32493 · Pypi · Ms-Swift

This appears to be a security vulnerability report describing a remote code execution RCE exploit in the ms-swift framework through malicious pickle deserialization in adapter model files. The vulnerability allows arbitrary command execution when loading specially crafted adapter models from...

CVE-2025-49840

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in inferencewebui.py. The GPTdropdown variable takes user input and passes it to the changegptweights function. In changegptweights, the user input,...

CVE-2025-49839 GHSL-2025-051: GPT-SoVITS Deserialization of Untrusted Data vulnerability

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in bsroformer.py. The modelchoose variable takes user input e.g. a path to a model and passes it to the uvr function. In uvr, a new instance of...

LLaMA-Factory allows Code Injection through improper vhead_file safeguards

Summary A critical remote code execution vulnerability was discovered during the Llama Factory training process. This vulnerability arises because the vheadfile is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passi...

Security Bulletin: There is a vulnerablity in the torch library affecting IBM watsonx Code Assistant On Prem

Summary There is a vulnerablity in the torch library affecting IBM watsonx Code Assistant On Prem. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2025-32434 DESCRIPTION: PyTorch is a Python package that provides tensor computation with...

GHSA-3749-GHW9-M3MG vulnerabilities

Vulnerabilities for packages: py3-torch-cuda-12.4, py3-torch-cuda-12.6...

CVE-2025-2953 vulnerabilities

Vulnerabilities for packages: py3-torch-cuda-12.4, py3-torch-cuda-12.6...

CVE-2025-5150 docarray Web API torch_dataset.py __getitem__ prototype pollution

A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function getitem of the file /docarray/data/torchdataset.py of the component Web API. The manipulation leads to improperly controlled modification of object prototype attributes...

DocArray 安全漏洞

DocArray is a DocArray open source tool for representing, sending, storing, and searching multimodal data. A security vulnerability exists in DocArray 0.40.1 and earlier versions that stems from a prototype contamination issue in the file /docarray/data/torchdataset.py...

CVE-2011-1416

The Research In Motion RIM BlackBerry Torch 9800 with firmware 6.0.0.246 allows attackers to read the contents of memory locations via unknown vectors, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011...

CVE-2025-4701

The CVE-2025-4701 issue affects VITA-MLLM Freeze-Omni (up to 20250421), specifically the torch.load usage in models/utils.py where improper handling of the path argument enables deserialization and a potential local-host exploit. Root cause: manipulation of the path parameter in torch.load leads ...

PT-2025-21290 · Unknown +1 · Vita-Mllm Freeze-Omni +1

Name of the Vulnerable Software and Affected Versions: VITA-MLLM Freeze-Omni up to 20250421 Description: A problematic issue has been found, affecting the torch.load function in the models/utils.py file. The manipulation of the path argument leads to deserialization, allowing an attack to be...

Unspecified Vulnerability in PyTorch (CNVD-2025-23289)

PyTorch is a Python package open-sourced by PyTorch. PyTorch has a security vulnerability that originates from improper handling of the function torch.cuda.nccl.reduce in the file torch/cuda/nccl.py, which can be exploited by an attacker to cause a denial of service...

Improper Resource Shutdown or Release

Overview torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration Affected versions of this package are vulnerable to Improper Resource Shutdown or Release through the torch.cuda.nccl.reduce function in the file torch/cuda/nccl.py. An attacker can cause the applicatio...

Malicious code in byted-torch-monitor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8c2b83888c7fcb79b930eaecb1a538d27a131ab415c0b756f84c7071d5a0935b During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...

MAL-2025-4207 Malicious code in byted-torch-monitor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8c2b83888c7fcb79b930eaecb1a538d27a131ab415c0b756f84c7071d5a0935b During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...

The vulnerability of the torch.load() function in the PyTorch machine learning framework allows a hacker to execute arbitrary code.

The vulnerability of the torch.load function in the PyTorch machine learning framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Deserialization of Untrusted Data

Overview llamafactory is an Easy-to-use LLM fine-tuning framework Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the torch.load function. An attacker can execute arbitrary commands by crafting a malicious .bin file that is then deserialized. PoC pyth...

PYSEC-2025-41

PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution RCE vulnerability exists in PyTorch when loading a model using torch.load with...