-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| torch | pip |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure deserialization in the PyTorch RPC framework. The _InternalRPCPickler.deserialize() method directly uses Python's native pickle deserialization (via pickle.Unpickler) on untrusted network input (PythonUDF objects). This allows attackers to craft malicious payloads that execute arbitrary code during deserialization. The code at line 162 in internal.py shows the vulnerable deserialization call without any validation safeguards. The connection to RCE is explicit in the advisory, and pickle deserialization vulnerabilities are well-known for enabling code execution.
Ongoing coverage of React2Shell