Remote Code Execution
797 entries
Every Remote Code Execution entry VulnWatch has indexed, sorted by publication date.
Subscribe to this tag's RSS feed
Keras framework vulnerable to deserialization of untrusted data
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModu...
The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.
**Note:** This report has already been discussed with the Google OSS VRP team, who recommended that I reach out directly to the Keras team. I’ve chosen to do so privately rather than opening a public...
Keras is vulnerable to Deserialization of Untrusted Data
### Arbitrary Code Execution in Keras Keras versions prior to 3.11.0 allow for arbitrary code execution when loading a crafted `.keras` model archive, even when `safe_mode=True`. The issue arises be...
Flowise has unsandboxed remote code execution via Custom MCP
### Summary The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization...
Flowise has arbitrary file access due to missing chat flow id validation
### Summary Missing chat flow id validation allows an attacker to access arbitrary file. ### Details Commit https://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f and...
Picklescan Bypass is Possible via File Extension Mismatch
### Summary Picklescan can be bypassed, allowing the detection of malicious pickle files to fail, when a standard pickle file is given a PyTorch-related file extension (e.g., .bin). This occurs becaus...
Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
### Summary Picklescan's ability to scan ZIP archives for malicious pickle files is compromised when the archive contains a file with a bad Cyclic Redundancy Check (CRC). Instead of attempting to scan...
Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
### Summary The vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from PickleScan's strict check for ful...
Monai: Unsafe use of Pickle deserialization may lead to RCE
>To prevent this report from being deemed inapplicable or out of scope, due to the project's unique nature (for medical applications) and widespread popularity (6k+ stars), it's important to pay atten...
MONAI: Unsafe torch usage may lead to arbitrary code execution
### Summary In ```model_dict = torch.load(full_path, map_location=torch.device(device), weights_only=True)``` in monai/bundle/scripts.py , ```weights_only=True``` is loaded securely. However, insecure...
Picklescan is missing detection when calling built-in Python cProfile.runctx
### Summary Using cProfile.runctx function, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the at...
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
### Summary Using idlelib.pyshell.ModifiedInterpreter.runcode function, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the fol...
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
### Summary Using idlelib.pyshell.ModifiedInterpreter.runcommand function, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the...
Picklescan is missing detection when calling built-in python ensurepip._run_pip
### Summary Using ensurepip._run_pip function, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the...
Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
### Summary Using idlelib.calltip.Calltip.fetch_tip, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: Firs...
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
### Summary Using idlelib.autocomplete.AutoComplete.fetch_completions, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the foll...
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
### Summary Using idlelib.autocomplete.AutoComplete.get_entity, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following s...
Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
### Summary Using idlelib.debugobj.ObjectTreeItem.SetText, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps:...
Picklescan has a missing detection when calling built-in python profile.Profile.runctx
### Summary Using profile.Profile.runctx, which is a built-in python library function to execute remote pickle file. ### Details The attack payload executes in the following steps: First, the atta...
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
### Summary Using torch.utils._config_module.load_config function, which is a pytorch library function to execute remote pickle file. ### Details The attack payload executes in the following steps:...
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
### Summary Using torch.jit.unsupported_tensor_ops.execWrapper function, which is a pytorch library function to execute remote pickle file. ### Details The attack payload executes in the following...
vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder
### Summary An unsafe deserialization vulnerability allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool ca...
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
### Summary It is possible to bypass the mitigation introduced in response to [CVE-2025-1550](https://github.com/keras-team/keras/security/advisories/GHSA-48g7-3x6r-xfhp), when an untrusted Keras v3 m...
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
### Details There's a parsing logic error in picklescan and modelscan while trying to deal with opcode `STACK_GLOBAL`. Function `_list_globals` when handling `STACK_GLOBAL` at position `n`, it is expe...
BentoML SSRF Vulnerability in File Upload Processing
### Description There's an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in t...