https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:41:59 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-04916 bdu:2025-04916 https://cve.radiocsirt.org/vuln/bdu:2025-04916 https://cve.radiocsirt.org/vuln/bit-pytorch-2025-32434 <p><strong>Affected:</strong> Bitnami: pytorch</p> <p>PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.</p> <p><strong>Affected:</strong> Bitnami: pytorch</p> <p>PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.</p> https://cve.radiocsirt.org/vuln/bit-pytorch-2025-32434 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0508 certfr-2025-avi-0508 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0508 https://cve.radiocsirt.org/vuln/cnvd-2025-23352 cnvd-2025-23352 https://cve.radiocsirt.org/vuln/cnvd-2025-23352 https://cve.radiocsirt.org/vuln/euvd-2026-262059 EUVD-2026-262059 https://cve.radiocsirt.org/vuln/euvd-2026-262059 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32434 <p>PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.</p> <p>PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-32434 https://cve.radiocsirt.org/vuln/ghsa-53q9-r3pm-6pq6 <p><strong>Affected:</strong> PyPI: torch</p> <p># Description I found a Remote Command Execution (RCE) vulnerability in PyTorch. When loading model using torch.load with weights_only=True, it can still achieve RCE.</p> <p># Background knowledge https://github.com/pytorch/pytorch/security As you can see, the PyTorch official documentation considers using `torch.load()` with `weights_only=True` to be safe.  Since everyone knows that weights_only=False is unsafe, so they will use the weights_only=True to mitigate the seucirty issue. But now, I just proved that even if you use weights_only=True, it can still achieve RCE.</p> <p># Credit This vulnerability was found by Ji&#39;an Zhou.</p> <p><strong>Affected:</strong> PyPI: torch</p> <p># Description I found a Remote Command Execution (RCE) vulnerability in PyTorch. When loading model using torch.load with weights_only=True, it can still achieve RCE.</p> <p># Background knowledge https://github.com/pytorch/pytorch/security As you can see, the PyTorch official documentation considers using `torch.load()` with `weights_only=True` to be safe.  Since everyone knows that weights_only=False is unsafe, so they will use the weights_only=True to mitigate the seucirty issue. But now, I just proved that even if you use weights_only=True, it can still achieve RCE.</p> <p># Credit This vulnerability was found by Ji&#39;an Zhou.</p> https://cve.radiocsirt.org/vuln/ghsa-53q9-r3pm-6pq6 https://cve.radiocsirt.org/vuln/msrc_cve-2025-32434 msrc_CVE-2025-32434 https://cve.radiocsirt.org/vuln/msrc_cve-2025-32434 https://cve.radiocsirt.org/vuln/pysec-2025-41 <p><strong>Affected:</strong> PyPI: torch</p> <p>PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.</p> <p><strong>Affected:</strong> PyPI: torch</p> <p>PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.</p> https://cve.radiocsirt.org/vuln/pysec-2025-41 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0857 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PyTorch ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PyTorch ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0857