Skip to content
Heist/ feed
Back to feed
High

vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator

Type: advisorySources: OSV

vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-24357
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 18:04 UTC · Revision 1

Source evidence

vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator

core-osv · Original source

Published 27 Jan 2025, 17:38 UTC

vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0.

osv:CVE-2025-24357
Complete source record
{
  "id": "b1ebcadd80e965ffed318efb3517604c246a8716974f7db3835789ec285aa845",
  "url": "https://osv.dev/vulnerability/CVE-2025-24357",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator",
    "summary": "vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0.",
    "evidence": "osv:CVE-2025-24357",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-24357",
      "aliases": [
        "CVE-2025-24357",
        "GHSA-rh4j-5rhw-hr54",
        "PYSEC-2025-58"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/vllm-project/vllm",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5204ff5c3feeb96e8a6eea65dfcb78395f90d4d8"
                },
                {
                  "fixed": "d3d6bb13fb62da3234addf6574922a4ec0513d04"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.7.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d3d6bb13fb62da3234addf6574922a4ec0513d04"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.6.6.post1",
            "v0.6.6",
            "v0.6.5",
            "v0.6.4.post1",
            "v0.6.4",
            "v0.6.3.post1",
            "v0.6.3",
            "v0.6.2",
            "v0.6.1.post2",
            "v0.6.1.post1",
            "v0.6.1",
            "v0.6.0",
            "v0.5.5",
            "v0.5.4",
            "v0.5.3.post1",
            "v0.5.3",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0.post1",
            "v0.5.0",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0.post1",
            "v0.4.0",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.7",
            "v0.2.6",
            "v0.2.5",
            "v0.2.4",
            "v0.2.3",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.7",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0",
            "submission"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24357.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.221029694Z",
      "provider": "osv",
      "references": [
        "https://pytorch.org/docs/stable/generated/torch.load.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24357.json",
        "https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-24357",
        "https://github.com/vllm-project/vllm/commit/d3d6bb13fb62da3234addf6574922a4ec0513d04",
        "https://github.com/vllm-project/vllm/pull/12366"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-502"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24357.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-24357",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505570,
  "published_at": "2025-01-27T17:38:20.07+00:00"
}