Security Digest · Critical advisory (no CVE assigned)
GHSA-ggpf-24jw-3fcw: CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0
Description https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading a malicious model could result in code execution on the vllm host.
CVSS 9.8 Critical GitHub-reviewed · critical
Should you act?
- Malicious code, not a bug. If any listed version was ever installed, assume the machine and every secret on it are compromised: remove it, rotate credentials, rebuild.
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
pip-audit (or: pip show <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | vllm | < 0.8.0 | 0.8.0 |
Details
Description
https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading a malicious model could result in code execution on the vllm host. The fix applied to specify weightsonly=True to calls to torch.load() did not solve the problem prior to PyTorch 2.6.0.
PyTorch has issued a new CVE about this problem: https://github.com/advisories/GHSA-53q9-r3pm-6pq6
This means that versions of vLLM using PyTorch before 2.6.0 are vulnerable to this problem. Background Knowledge When users install VLLM according to the official manual
But the version of PyTorch is specified in the requirements. txt file
So by default when the user install VLLM, it will install the PyTorch with version 2.5.1
In CVE-2025-24357, weightsonly=True was used for patching, but we know this is not secure. Because we found that using Weightsonly=True in pyTorch before 2.5.1 was unsafe
Here, we use this interface to prove that it is not safe.
CVSS: 9.8 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-ggpf-24jw-3fcw github.com
- github.com github.com
- github.com github.com
- github.com github.com