This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2025-50461 | BDVDB-2026-290291 Detail

Description#

A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/model_merger.py script when using the "fsdp" backend. The script calls torch.load() with weights_only=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted model file is loaded. An attacker can exploit this by convincing a victim to download and place a malicious model file in a local directory with a specific filename pattern. This vulnerability may lead to arbitrary code execution with the privileges of the user running the script.

Impact#

Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.