CVE-2025-50460

A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Anchor0221/CVE-2025-50460
https://github.com/advisories/GHSA-6757-jp84-gxfx
https://github.com/modelscope/ms-swift
https://github.com/modelscope/ms-swift/blob/main/tests/run.py#L420
https://github.com/Anchor0221/CVE-2025-50460

Configurations

No configuration.

History

No history.

Information

Published : 2025-08-01 16:15

Updated : 2025-08-04 15:06

NVD link : CVE-2025-50460

Mitre link : CVE-2025-50460

CVE.ORG link : CVE-2025-50460

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-50460", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-08-01T16:15:41.600", "references": [{"url": "https://github.com/Anchor0221/CVE-2025-50460", "source": "cve@mitre.org"}, {"url": "https://github.com/advisories/GHSA-6757-jp84-gxfx", "source": "cve@mitre.org"}, {"url": "https://github.com/modelscope/ms-swift", "source": "cve@mitre.org"}, {"url": "https://github.com/modelscope/ms-swift/blob/main/tests/run.py#L420", "source": "cve@mitre.org"}, {"url": "https://github.com/Anchor0221/CVE-2025-50460", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue."}, {"lang": "es", "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) en el proyecto ms-swift versi\u00f3n 3.3.0 debido a una deserializaci\u00f3n insegura en tests/run.py mediante yaml.load() de la librer\u00eda PyYAML (versiones = 5.3.1). Si un atacante controla el contenido del archivo de configuraci\u00f3n YAML transferido al par\u00e1metro --run_config, se puede ejecutar c\u00f3digo arbitrario durante la deserializaci\u00f3n. Esto puede comprometer completamente el sistema. La vulnerabilidad se activa al cargar un archivo YAML malicioso, lo que permite la ejecuci\u00f3n de comandos Python arbitrarios como os.system(). Se recomienda actualizar PyYAML a la versi\u00f3n 5.4 o superior y usar yaml.safe_load() para mitigar el problema."}], "lastModified": "2025-08-04T15:06:15.833", "sourceIdentifier": "cve@mitre.org"}