Security Digest · Critical advisory (no CVE assigned)
GHSA-m9mp-6x32-5rhg: scio is vunerable to Remote Command Execution through PyTorch
Impact PyTorch reported a critical vulnerability when using torch.load, even with option weightsonly=True, for torch = 2.6, starting from scio >= 1.0.1 (currently in dev state).
CVSS 9.3 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
pip-audit (or: pip show <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | scio-pypi | <= 1.0.0 | none listed |
Details
Impact PyTorch reported a critical vulnerability when using torch.load, even with option weightsonly=True, for torch
In scio
Patches The lower bound was changed to torch >= 2.6, starting from scio >= 1.0.1 (currently in dev state).
Workarounds You can manually check that you are using torch >= 2.6.
CVSS: 9.3 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Sources and references
- GitHub Advisory GHSA-m9mp-6x32-5rhg github.com
- github.com github.com
- github.com github.com