Deserialization Of Untrusted Data

🗓️ 30 Jan 2025 14:02:42Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 6 Views

vLLM is vulnerable to unsafe deserialization allowing arbitrary code execution via malicious pickle data.

Reporter	Title	Published	Views	Family All 16
Chainguard	CVE-2025-24357 vulnerabilities	27 Jan 202518:15	–	cgr
Circl	CVE-2025-24357	27 Jan 202517:41	–	circl
CNNVD	vLLM 代码问题漏洞	27 Jan 202500:00	–	cnnvd
CVE	CVE-2025-24357	27 Jan 202517:38	–	cve
Cvelist	CVE-2025-24357 vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator	27 Jan 202517:38	–	cvelist
EUVD	EUVD-2025-0192	3 Oct 202520:07	–	euvd
Github Security Blog	CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0	23 Apr 202502:26	–	github
Github Security Blog	vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator	27 Jan 202520:50	–	github
NVD	CVE-2025-24357	27 Jan 202518:15	–	nvd
OSV	CGA-MJV6-3389-F59V	29 Jan 202600:47	–	osv

Vulners

Node

vllm vllmRange0.1.5–0.6.6python

vllm vllmMatch0.0.1python

vllm vllmMatch0.1.0python

vllm vllmMatch0.1.1python

vllm vllmMatch0.1.2python

vllm vllmMatch0.1.3python

vllm vllmMatch0.1.4python

vllm vllmMatch0.1.5python

vllm vllmMatch0.1.6python

vllm vllmMatch0.1.7python

vllm vllmMatch0.2.0python

vllm vllmMatch0.2.1python

vllm vllmMatch0.2.1.post1python

vllm vllmMatch0.2.2python

vllm vllmMatch0.2.3python

vllm vllmMatch0.2.4python

vllm vllmMatch0.2.5python

vllm vllmMatch0.2.6python

vllm vllmMatch0.2.7python

vllm vllmMatch0.3.0python

vllm vllmMatch0.3.1python

vllm vllmMatch0.3.2python

vllm vllmMatch0.3.3python

vllm vllmMatch0.4.0python

vllm vllmMatch0.4.0.post1python

vllm vllmMatch0.4.1python

vllm vllmMatch0.4.2python

vllm vllmMatch0.4.3python

vllm vllmMatch0.5.0python

vllm vllmMatch0.5.0.post1python

vllm vllmMatch0.5.1python

vllm vllmMatch0.5.2python

vllm vllmMatch0.5.3python

vllm vllmMatch0.5.3.post1python

vllm vllmMatch0.5.4python

vllm vllmMatch0.5.5python

vllm vllmMatch0.6.0python

vllm vllmMatch0.6.1python

vllm vllmMatch0.6.1.post1python

vllm vllmMatch0.6.1.post2python

vllm vllmMatch0.6.2python

vllm vllmMatch0.6.3python

vllm vllmMatch0.6.3.post1python

vllm vllmMatch0.6.4python

vllm vllmMatch0.6.4.post1python

vllm vllmMatch0.6.5python

vllm vllmMatch0.6.6.post1python

Source	Link
github	www.github.com/vllm-project/vllm/releases/tag/v0.7.0
github	www.github.com/vllm-project/vllm/pull/12366
github	www.github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54
github	www.github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2025-58.yaml
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-24357
github	www.github.com/vllm-project/vllm/commit/d3d6bb13fb62da3234addf6574922a4ec0513d04
pytorch	www.pytorch.org/docs/stable/generated/torch.load.html
github	www.github.com/vllm-project/vllm

13 Dec 2025 07:43Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5 - 8.8

EPSS0.00665