CVE-2025-50460: ms-swift PyYAML Deserialization RCE Flaw

CVE-2025-50460 Overview

A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions ≤ 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system().

Critical Impact

This insecure deserialization vulnerability enables remote code execution with no authentication required. Attackers who can supply a malicious YAML configuration file can achieve complete system compromise, potentially affecting machine learning pipelines and model training infrastructure.

Affected Products

• ms-swift version 3.3.0
• Systems using PyYAML versions ≤ 5.3.1
• ModelScope machine learning infrastructure utilizing vulnerable ms-swift configurations

Discovery Timeline

• 2025-08-01 - CVE-2025-50460 published to NVD
• 2025-08-04 - Last updated in NVD database

Technical Details for CVE-2025-50460

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), a well-known class of security flaws that can lead to severe consequences including remote code execution. The ms-swift project, developed by ModelScope for machine learning workflows, contains a critical flaw in its test infrastructure that could be exploited in production or development environments where the test scripts are accessible.

The vulnerability stems from the use of the unsafe yaml.load() function without specifying a safe loader. In PyYAML versions prior to 5.4, the default behavior of yaml.load() allows arbitrary Python object instantiation during the deserialization process. This means that specially crafted YAML payloads can execute arbitrary Python code when parsed.

The impact of successful exploitation is severe: attackers gain the ability to execute arbitrary commands on the target system with the privileges of the running process. In machine learning environments, this could compromise training data, model integrity, and underlying infrastructure.

Root Cause

The root cause is the use of yaml.load() without a safe loader in tests/run.py at line 420. The PyYAML library's yaml.load() function, when called without specifying Loader=yaml.SafeLoader, will deserialize arbitrary Python objects. This behavior allows attackers to craft YAML files containing Python object tags (like !!python/object/apply:os.system) that execute code during parsing.

The vulnerable code pattern processes user-controllable YAML configuration files through the --run_config parameter without proper sanitization or use of safe deserialization methods.

Attack Vector

The attack is network-based and requires the attacker to control or inject a malicious YAML configuration file that will be processed by the vulnerable tests/run.py script. The attack flow consists of:

1. Attacker creates a malicious YAML file containing Python object constructors
2. The malicious YAML payload utilizes PyYAML's object instantiation syntax to invoke dangerous functions like os.system()
3. When the victim system loads the configuration via the --run_config parameter, the YAML parser deserializes the malicious objects
4. During deserialization, the attacker's arbitrary Python code executes with the privileges of the running process

The vulnerability requires no authentication and has low attack complexity. An attacker with the ability to supply or modify YAML configuration files can achieve full code execution on vulnerable systems.

Detection Methods for CVE-2025-50460

Indicators of Compromise

• Unexpected YAML files appearing in configuration directories with unusual content patterns
• Process executions spawned from Python processes running tests/run.py that are not part of normal operations
• Log entries showing the loading of YAML configurations from untrusted sources or unusual paths
• Network connections or file system modifications originating from the ms-swift test process

Detection Strategies

• Monitor for invocations of tests/run.py with the --run_config parameter pointing to non-standard or user-writable locations
• Scan YAML configuration files for suspicious patterns including !!python/object, !!python/object/apply, and !!python/module
• Implement file integrity monitoring on configuration directories used by ms-swift
• Use application whitelisting to control which configuration files can be loaded

Monitoring Recommendations

• Enable verbose logging for the ms-swift application to capture configuration file paths and loading events
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process trees originating from Python interpreters
• Implement network monitoring to detect anomalous outbound connections from machine learning infrastructure
• Configure SIEM alerts for unusual command execution patterns from systems running ms-swift

How to Mitigate CVE-2025-50460

Immediate Actions Required

• Upgrade PyYAML to version 5.4 or higher, which enforces safe loading by default
• Replace all instances of yaml.load() with yaml.safe_load() in the codebase
• Restrict access to the tests/run.py script and ensure it is not accessible in production environments
• Audit all YAML configuration files for malicious content before processing

Patch Information

The recommended fix involves two key changes:

1. Upgrade PyYAML: Update the PyYAML library to version 5.4 or higher where the default behavior has been changed to require an explicit loader specification
2. Use Safe Loader: Modify the code to explicitly use yaml.safe_load() or yaml.load(file, Loader=yaml.SafeLoader) to prevent arbitrary object instantiation

For additional technical details and proof-of-concept information, refer to the GitHub PoC Repository, the GitHub Security Advisory, and the vulnerable code location.

Workarounds

• Implement strict input validation on all YAML configuration file paths, allowing only trusted, hardcoded locations
• Run the ms-swift test environment in an isolated sandbox or container with minimal privileges
• Deploy a YAML content filter that rejects any configuration containing Python object tags
• Remove or restrict access to tests/run.py in environments where the test suite is not required

# Configuration example - Upgrade PyYAML to safe version
pip install --upgrade "PyYAML>=5.4"

# Verify the installed version
pip show PyYAML | grep Version

# Alternative: Pin the safe version in requirements.txt
echo "PyYAML>=5.4" >> requirements.txt