---
title: "GHSA-m9mp-6x32-5rhg: scio is vunerable to  Remote Command Execution  through PyTorch"
url: https://erroneo.us/security/ghsa/GHSA-m9mp-6x32-5rhg/
description: "GHSA-m9mp-6x32-5rhg (critical, PyPI): scio is vunerable to Remote Command Execution through PyTorch. Impact PyTorch reported a critical vulnerability when…"
type: advisory
section: "Security Digest"
date_published: 2025-10-09
date_modified: 2025-10-09
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-m9mp-6x32-5rhg"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-m9mp-6x32-5rhg: scio is vunerable to  Remote Command Execution  through PyTorch

## Affected packages

- PyPI `scio-pypi` <= 1.0.0 → fixed: none listed

## Details

Impact PyTorch reported a critical vulnerability when using torch.load, even with option weightsonly=True, for torch = 2.6, starting from scio >= 1.0.1 (currently in dev state). Workarounds You can manually check that you are using torch >= 2.6.

## Sources

- [GitHub Advisory GHSA-m9mp-6x32-5rhg](https://github.com/advisories/GHSA-m9mp-6x32-5rhg)
- [github.com](https://github.com/ThalesGroup/scio/security/advisories/GHSA-m9mp-6x32-5rhg)
- [github.com](https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6)

---
Source page: https://erroneo.us/security/ghsa/GHSA-m9mp-6x32-5rhg/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt