Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/model_merger.py script when using the "fsdp" backend. The script calls torch.load() with weights_only=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted model file is loaded. An attacker can exploit this by convincing a victim to download and place a malicious model file in a local directory with a specific filename pattern. This vulnerability may lead to arbitrary code execution with the privileges of the user running the script.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Volcengine verl 安全漏洞
Vulnerability Description
Volcengine verl是Volcengine开源的一个大语言模型库。 Volcengine verl 3.0.0版本存在安全漏洞，该漏洞源于反序列化不当，可能导致任意代码执行。
CVSS Information
N/A
Vulnerability Type
N/A