CVE-2025-50472: ModelScope ms-swift RCE Vulnerability

CVE-2025-50472 Overview

CVE-2025-50472 is an insecure deserialization vulnerability affecting the modelscope/ms-swift library through version 2.6.1. The vulnerability exists within the load_model_meta() function of the ModelFileSystemCache() class, where untrusted data is processed using Python's pickle.load() function. This allows attackers to craft malicious serialized .mdl payload files that execute arbitrary code when loaded by victims during what appears to be a normal model training process.

The attack vector is particularly insidious because the malicious payload file is hidden, making detection difficult, and the normal training process continues unaffected after code execution—leaving the victim completely unaware that their system has been compromised.

Critical Impact

This vulnerability enables remote code execution through malicious model checkpoint files. Attackers can execute arbitrary commands on targeted machines while the victim remains unaware, as normal training operations continue uninterrupted after exploitation.

Affected Products

• modelscope/ms-swift library versions through 2.6.1
• Python applications utilizing the ModelFileSystemCache() class
• Machine learning environments loading untrusted model checkpoints

Discovery Timeline

• 2025-08-01 - CVE-2025-50472 published to NVD
• 2025-08-04 - Last updated in NVD database

Technical Details for CVE-2025-50472

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data), a well-known class of security issues that can lead to severe consequences including remote code execution. The ms-swift library, used for fine-tuning and deploying large language models in the ModelScope ecosystem, contains a caching utility that processes serialized model metadata files.

The core issue stems from the library's use of Python's pickle module to deserialize .mdl files without proper validation. The pickle format is inherently insecure when processing data from untrusted sources, as it can execute arbitrary Python code during the deserialization process. An attacker who can place a malicious .mdl file in a location where the library will load it can achieve code execution with the privileges of the process running the training operation.

The attack is particularly dangerous in machine learning workflows because model checkpoints are frequently shared between researchers, downloaded from public repositories, or transferred between systems. The hidden nature of the payload file and the fact that training continues normally after exploitation means that compromised systems may operate for extended periods without any indication of breach.

Root Cause

The root cause of this vulnerability is the unsafe use of pickle.load() within the load_model_meta() function of the ModelFileSystemCache() class. Python's pickle module can instantiate arbitrary Python objects during deserialization, which attackers can exploit to execute malicious code.

The vulnerable code path is located in the caching utility at line 141 of caching.py. When the library loads model metadata from .mdl files, it trusts the serialized content without validation, allowing crafted payloads to execute arbitrary system commands.

Attack Vector

The attack leverages the network-accessible nature of machine learning model repositories and checkpoint sharing. An attacker can execute this attack through several vectors:

1. Supply Chain Attack: Compromising a model repository or checkpoint hosting service to inject malicious .mdl files
2. Social Engineering: Convincing researchers to download and use a seemingly legitimate model checkpoint containing the malicious payload
3. Shared Storage Compromise: Gaining write access to shared training directories or network file systems

The vulnerability is exploitable without authentication and requires no user interaction beyond loading the compromised checkpoint file. The attack executes automatically during the load_model_meta() function call, and because the malicious file is hidden and training continues normally, victims have no immediate indication of compromise.

Since no verified code examples are available, the vulnerability mechanism can be understood through the vulnerable source code in caching.py and the CVE-2025-50472 proof-of-concept repository which contain technical details about the exploitation technique.

Detection Methods for CVE-2025-50472

Indicators of Compromise

• Presence of unexpected hidden .mdl files in model checkpoint directories
• Unusual process spawning from Python training processes, particularly shell processes or network connections
• Modifications to model checkpoint files with timestamps inconsistent with legitimate training activities
• Unexpected network connections originating from machine learning training environments

Detection Strategies

• Implement file integrity monitoring on model checkpoint directories to detect unauthorized modifications
• Monitor for pickle.load() calls processing data from external or untrusted sources in application logs
• Use endpoint detection and response (EDR) solutions to identify suspicious child processes spawned during training operations
• Deploy behavioral analysis to detect anomalous system calls from Python processes during model loading phases

Monitoring Recommendations

• Enable verbose logging for model loading operations in ms-swift applications
• Configure alerts for new or modified hidden files (files starting with .) in training directories
• Implement network segmentation to isolate machine learning training environments from sensitive internal resources
• Monitor for unusual outbound connections from training hosts that may indicate command-and-control communication

How to Mitigate CVE-2025-50472

Immediate Actions Required

• Audit all model checkpoints and .mdl files in use for signs of tampering or unexpected content
• Implement strict access controls on model checkpoint storage locations to prevent unauthorized modifications
• Isolate machine learning training environments using containers or virtual machines with limited network access
• Only load model checkpoints from trusted, verified sources with cryptographic integrity validation

Patch Information

As of the last update on 2025-08-04, users should monitor the ms-swift GitHub repository for security patches addressing this deserialization vulnerability. Check for updates beyond version 2.6.1 that implement safe deserialization practices.

Workarounds

• Validate the integrity of all .mdl files using cryptographic checksums before loading
• Replace pickle.load() with safer alternatives like json or implement a restricted unpickler that only allows specific safe object types
• Run training processes in sandboxed environments with limited system privileges
• Implement a pre-loading scanner that inspects .mdl file contents for suspicious pickle opcodes before deserialization

# Example: Scan for potentially malicious pickle files before loading
# This command finds hidden .mdl files which may indicate tampering
find /path/to/model/checkpoints -name ".*mdl" -type f -ls

# Verify file integrity using checksums
sha256sum /path/to/model/checkpoints/*.mdl > checksums.txt
sha256sum -c checksums.txt