Database/AI/ML frameworks & serving
PyTorch (`torch.jit.annotations.parse_type_line`): Arbitrary code execution via unsafe `eval` in TorchScript type
CVSS 9.8CVE-2022-45907AI/ML frameworks & servingcurated
Impact
Arbitrary code execution via unsafe eval in TorchScript type parsing
Who can reach it
Customer-supplied TorchScript model file
What to do
Patch torch in base images; TorchScript ingest of untrusted models should be sandboxed regardless
References
Related entries
- MLflow: Path traversal prior to 2.3.1CVE-2023-2780 · MLflowCritical
- LangChain (`LLMMathChain`): Prompt injectionCVE-2023-29374 · LangChain (`LLMMathChain`)Critical
- LangChain (PALChain): Arbitrary code execution via `os.system`/`exec` in generated codeCVE-2023-36258 · LangChain (PALChain)Critical
- LangChain (`load_prompt`): Arbitrary code execution from a JSON prompt fileCVE-2023-36281 · LangChain (`load_prompt`)Critical
- langchain-experimental (PALChain): Bypass of the CVE-2023-36258 fixCVE-2023-44467 · langchain-experimental (PALChain)Critical
- Ray (job submission API): Unauthenticated RCE — the Jobs API accepts arbitrary code by designCVE-2023-48022 · Ray (job submission API)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.