Remote Code Execution Vulnerability in ms-swift Project by ModelScope
CVE-2025-50460
Key Information:
- Vendor
ModelScope
- Status
- Vendor
- CVE Published:
- 1 August 2025
Badges
What is CVE-2025-50460?
A remote code execution vulnerability has been identified in version 3.3.0 of the ms-swift project. This issue arises from unsafe deserialization in the tests/run.py component, where the yaml.load() function from the PyYAML library (version 5.3.1) is utilized. If an attacker manages to manipulate the YAML configuration file fed to the --run_config parameter, they could execute arbitrary code during deserialization, potentially leading to full system compromise. The vulnerability is activated when a malicious YAML file is processed, allowing execution of arbitrary Python commands, including os.system(). To mitigate this issue, it is advised to upgrade PyYAML to version 5.4 or above and to implement yaml.safe_load().
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.