https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 19:14:17 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2025-50461 <p>A deserialization vulnerability exists in Volcengine&#39;s verl 3.0.0, specifically in the scripts/model_merger.py script when using the &#34;fsdp&#34; backend. The script calls torch.load() with weights_only=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted model file is loaded. An attacker can exploit this by convincing a victim to download and place a malicious model file in a local directory with a specific filename pattern. This vulnerability may lead to arbitrary code execution with the privileges of the user running the script.</p> <p>A deserialization vulnerability exists in Volcengine&#39;s verl 3.0.0, specifically in the scripts/model_merger.py script when using the &#34;fsdp&#34; backend. The script calls torch.load() with weights_only=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted model file is loaded. An attacker can exploit this by convincing a victim to download and place a malicious model file in a local directory with a specific filename pattern. This vulnerability may lead to arbitrary code execution with the privileges of the user running the script.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2025-50461 https://vulnerability.circl.lu/vuln/ghsa-xhf5-3r9v-mm67 <p>A deserialization vulnerability exists in Volcengine&#39;s verl 3.0.0, specifically in the scripts/model_merger.py script when using the &#34;fsdp&#34; backend. The script calls torch.load() with weights_only=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted model file is loaded. An attacker can exploit this by convincing a victim to download and place a malicious model file in a local directory with a specific filename pattern. This vulnerability may lead to arbitrary code execution with the privileges of the user running the script.</p> <p>A deserialization vulnerability exists in Volcengine&#39;s verl 3.0.0, specifically in the scripts/model_merger.py script when using the &#34;fsdp&#34; backend. The script calls torch.load() with weights_only=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted model file is loaded. An attacker can exploit this by convincing a victim to download and place a malicious model file in a local directory with a specific filename pattern. This vulnerability may lead to arbitrary code execution with the privileges of the user running the script.</p> https://vulnerability.circl.lu/vuln/ghsa-xhf5-3r9v-mm67