漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
Vulnerability Description
A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
SWIFT 安全漏洞
Vulnerability Description
SWIFT是ModelScope开源的一个大模型与多模态大模型微调部署框架。 SWIFT 3.3.0版本存在安全漏洞，该漏洞源于PyYAML库中yaml.load()不安全反序列化，可能导致任意代码执行。
CVSS Information
N/A
Vulnerability Type
N/A