GHSA-r54c-2xmf-2cf3: 
Python vulnerability analysis and mitigation

A remote code execution (RCE) vulnerability was discovered in the ms-swift framework (GHSA-r54c-2xmf-2cf3) affecting versions prior to 3.7. The vulnerability allows arbitrary command execution through malicious pickle deserialization when loading specially crafted adapter models from ModelScope. The issue was discovered by TencentAISec and disclosed on July 31, 2025 (GitHub Advisory).

The vulnerability exists in the model loading functionality of ms-swift when handling adapter model files. It specifically occurs when using torch.load() operations on untrusted adapter model files. The vulnerability requires the machine to have torch version < 2.6.0, while ms-swift accepts torch version >= 2.0. The exploitation involves creating a malicious adaptermodel.bin file using Python's pickle module with a crafted payload that leverages the _reduce__ method to execute arbitrary system commands (GitHub Advisory).

The vulnerability allows attackers to execute arbitrary system commands on the target system through specially crafted adapter model files. This could lead to complete system compromise, as the commands would run with the same privileges as the ms-swift application process (GitHub Advisory).

The vulnerability has been patched in ms-swift version 3.7 and later by disabling unsafe torch.load operations. Users are strongly advised to upgrade to version 3.7 or later to mitigate this vulnerability (GitHub Advisory).