# GHSA-r54c-2xmf-2cf3: MS SWIFT Deserialization RCE Vulnerability

> Attackers can execute arbitrary code by uploading malicious pickle files to ModelScope, which are deserialized when loading adapter models in ms-swift.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** No
- **Published:** 31 Jul 2025

## What is GHSA-r54c-2xmf-2cf3?

GHSA-r54c-2xmf-2cf3 is an unsafe deserialization vulnerability in ms-swift, published on 31 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

This appears to be a security vulnerability report describing a remote code execution (RCE) exploit in the ms-swift framework through malicious pickle deserialization in adapter model files. The vulnerability allows arbitrary command execution when loading specially crafted adapter models from ModelScope.

This occurs when using machine torch version < 2.6.0, while ms-swift accepts torch version >= 2.0

**I. Detailed Description:**
1. Install ms-swift
```
pip install ms-swift -U
```

2. Start web-ui
```
swift web-ui --lang en
```

3. After startup, you can access [http://localhost:7860/](http://localhost:7860/) through your browser to see the launched fine-tuning framework program

4. Upload an adapter model repository (cyjhhh/lora_adapter_4_llama3) on ModelScope, where the lora/adapter_model.bin file is generated through the following code:
```python
import torch, pickle, os

class MaliciousPayload:
   def __reduce__(self):
       return (os.system, ("touch /tmp/malicious.txt",))  # Arbitrary command

malicious_data = {
   "v_head.summary.weight": MaliciousPayload(),
   "v_head.summary.bias": torch.randn(10)
}

if __name__ == "__main__":
   with open("adapter_model.bin", "wb") as f:
       pickle.dump(malicious_data, f)
```

5. First training submission: First, fill in the required parameters in the LLM Training interface, including Model id and Dataset Code, and configure the following in the Other params section of Advanced settings

6. Click Begin to submit. You can see the backend command running as follows

7. By reading the ms-swift source code, swift.llm.model.utils#safe_snapshot_download() and modelscope.hub.utils.utils#get_cache_dir(), we can see that adapters are downloaded locally to the path ~/.cache/modelscope. Therefore, the complete local path for the specified remote adapters after download is:
```
~/.cache/modelscope/hub/models/cyjhhh/lora_adapter_4_llama3
```
Wait for the first submission program until the adapters download is complete, then you can click "kill running task" on the page to terminate the first training

8. Second training submission, configure the page parameters as follows

Click submit to see the backend command running as follows

9. After waiting for a while, you can see that torch.load() loaded the malicious adapter_model.bin file and successfully executed the command. Related execution information can also be seen in the log file corresponding to --logging_dir

10. Note (Prerequisites)
Requires machine torch version < 2.6.0, while ms-swift accepts torch version >= 2.0

**II. Vulnerability Proof:**
1. Remote downloaded adapter malicious model: [[lora_adapter_4_llama3](https://www.modelscope.cn/models/cyjhhh/lora_adapter_4_llama3/files)](https://www.modelscope.cn/models/cyjhhh/lora_adapter_4_llama3/files)
2. For the second training submission, it's recommended to follow the parameters shown in the screenshots above for reproduction, as it will validate the target modules specified in the base model and adapter config. If they don't match, the program will terminate early. It's also recommended to select the same dataset content as shown in the screenshots
3. This report only reproduces RCE for one entry point (single path). In reality, there are more than one path in the code that can cause deserialization RCE

**III. Fix Solution:**
```
SWIFT has disabled torch.load operations from 3.7 or later.
```

## Author

* Discovered by: [TencentAISec](https://github.com/TencentAISec)
* Contact: *[security@tencent.com](mailto:security@tencent.com)*

## Which versions are affected by GHSA-r54c-2xmf-2cf3?

2 open source packages ship an affected version, including ms-swift.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `ms-swift` | PyPI | All versions to 3.6.3 | None |
| `ms-swift` | PyPI | All versions to 3.6.3 | None |

## How do I fix GHSA-r54c-2xmf-2cf3?

No fix has been published for GHSA-r54c-2xmf-2cf3 yet. Limit exposure of the affected software until one is available.

## Is GHSA-r54c-2xmf-2cf3 being exploited?

There is no known exploitation of GHSA-r54c-2xmf-2cf3 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-r54c-2xmf-2cf3 and fix it if it is affected.

What it is: GHSA-r54c-2xmf-2cf3 is an unsafe deserialization vulnerability in ms-swift, published on 31 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-r54c-2xmf-2cf3 in the wild and no public exploit code.

Affected packages and fixed versions:
- ms-swift (PyPI): affected all versions up to 3.6.3; no fix listed
- ms-swift (PyPI): affected all versions up to 3.6.3; no fix listed

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-r54c-2xmf-2cf3/ (Markdown: https://insights.sbomify.com/GHSA-r54c-2xmf-2cf3/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-r54c-2xmf-2cf3

---
From sbomify Insights: https://insights.sbomify.com/GHSA-r54c-2xmf-2cf3/
Summaries are generated and may contain mistakes; the official description above is the record.