Kritik CVSS 9.8 PoC var
CVE-2025-65213: Torch Musa: güvenilmeyen verinin serileştirmeden çıkarılması
Açıklama (NVD)
MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without validation, allowing arbitrary code execution. An attacker can craft a malicious pickle file that executes arbitrary Python code when loaded, enabling remote code execution with the privileges of the victim process.
Özet bilgiler
- Ürün
- Mthreads Torch Musa
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,74 (yüzdelik 55)
- CWE
- CWE-502
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| mthreads-torch-musa | — | — | — |