{"id":"CVE-2025-50460","published":"2025-08-01T00:00:00Z","modified":"2025-08-01T17:22:46Z","title":"A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization…","vendor":null,"product":null,"tier":"tail","description":{"text":"A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.02686,"percentile":0.85853,"provenance":"source"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://github.com/modelscope/ms-swift","tags":[]},{"url":"https://github.com/modelscope/ms-swift/blob/main/tests/run.py#L420","tags":[]},{"url":"https://github.com/advisories/GHSA-6757-jp84-gxfx","tags":[]},{"url":"https://github.com/Anchor0221/CVE-2025-50460","tags":[]}],"priority":{"score":29.0,"factors":[{"name":"EPSS percentile","points":17.17},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.86}]},"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-07-30","earliestUrl":"https://github.com/Anchor0221/CVE-2025-50460","repos":[{"name":"Anchor0221/CVE-2025-50460","url":"https://github.com/Anchor0221/CVE-2025-50460","stars":0,"created":"2025-07-30"},{"name":"ferralon-demo/ms-swift-yaml-load-rce","url":"https://github.com/ferralon-demo/ms-swift-yaml-load-rce","stars":0,"created":"2026-10-07"}]},"first":{"date":"2025-07-30","source":"PoC-in-GitHub","url":"https://github.com/Anchor0221/CVE-2025-50460"},"provenance":"source"},"affected":[{"ecosystem":"PyPI","package":"ms-swift","vulnerableRanges":["<=3.6.3"],"patched":[],"from":["GHSA-fm6c-f59h-7mmg","PYSEC-2026-1683"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-23369","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-pyyaml-cve-2020-1747","parents":[{"from":"CVE-2020-1747","to":"CVE-2025-50460","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-fm6c-f59h-7mmg","via":"reference","url":"https://github.com/advisories/GHSA-6757-jp84-gxfx"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-1683","via":"reference","url":"https://github.com/advisories/GHSA-6757-jp84-gxfx"}]}]}}