CVE-2025-50472
Published: 01 August 2025
Summary
CVE-2025-50472 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Software Supply Chain (T1195.002); ranked in the top 22.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-7 (Software, Firmware, and Information Integrity).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the deserialization vulnerability by requiring timely remediation through patching the ms-swift library beyond version 2.6.1.
Enforces integrity verification of software and information such as the .mdl model checkpoint files to prevent execution of tampered payloads via unsafe deserialization.
Requires verification of component authenticity for model artifacts from external sources prior to loading, countering supply-chain attacks via malicious .mdl payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables supply-chain compromise via malicious .mdl model artifacts (pickle deserialization RCE) and direct execution through loading of the tampered file during normal ML workflows.
NVD Description
The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` function of the `ModelFileSystemCache()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized `.mdl` payload, exploiting the…
more
use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine. Note that the payload file is a hidden file, making it difficult for the victim to detect tampering. More importantly, during the model training process, after the `.mdl` file is loaded and executes arbitrary code, the normal training process remains unaffected'meaning the user remains unaware of the arbitrary code execution.
Deeper analysisAI
CVE-2025-50472 is a critical vulnerability in the modelscope/ms-swift library through version 2.6.1, stemming from arbitrary code execution via deserialization of untrusted data. The issue resides in the `load_model_meta()` function of the `ModelFileSystemCache()` class, which uses `pickle.load()` on potentially untrusted data from a serialized `.mdl` payload. This flaw, classified under CWE-502 (Deserialization of Untrusted Data), carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
Attackers can exploit this vulnerability remotely without privileges by crafting a malicious serialized `.mdl` payload, which is stored as a hidden file to evade detection. Exploitation occurs when victims load the seemingly harmless checkpoint during a normal model training process, triggering arbitrary code and command execution on the target machine. Notably, the training process continues unaffected post-exploitation, leaving users unaware of the compromise.
For mitigation details, security practitioners should review the referenced sources: the vulnerable code in swift/hub/utils/caching.py at line 141 (https://github.com/modelscope/ms-swift/blob/ab38bff0387a86fd9f068246c326ee7b0d5ed139/swift/hub/utils/caching.py#L141) and the dedicated CVE repository (https://github.com/xhjy2020/CVE-2025-50472), which may include patches or workarounds for upgrading beyond version 2.6.1.
This vulnerability is particularly relevant in AI/ML workflows, as ms-swift is used for model training and checkpoint handling in the ModelScope ecosystem, potentially exposing machine learning pipelines to supply-chain attacks via tampered model artifacts. No real-world exploitation has been reported as of the CVE publication on 2025-08-01.
Details
- CWE(s)