CVE-2025-50460

216.73.217.22

· Published 01/08/2025 16:15 · Modified 01/08/2025 18:15

Labels: CVE-2025-50460 2025-08-01 CVE-2025-50460 CWE-502 [email protected]

Essential information

Published: 01/08/2025 16:15
Modified: 01/08/2025 18:15
Author: —
Creator: —
CVSS: 9.8 CRITICAL (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS metrics

Description

A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
ms-swift / ms-swift	`cpe:2.3:a:ms-swift:ms-swift:3.3.0:::::::*`
pyyaml / pyyaml	`cpe:2.3:a:pyyaml:pyyaml:<5.4:::::::*`