CVE-2025-50460

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 2.49%
EPSS Percentile: 84.44%
CISA KEV: Not listed

Description

A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 01-Aug-2025 23:15
Last Modified: 17-Jun-2026 16:35
EPSS Date: 2026-10-20
CWE: CWE-502

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 21-Oct-2026 16:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

parsing (as seen in CVE-2025-50460). Config files can also to analyze configs in the context of their runtime code and HiddenLayer’s 2026 AI Threat Report Highlights Agentic Security and Supply Chain Gaps

CVE (2)

Malware (2)

People (1)

Threat Actors (5)

MITRE ATT&CK (8)

Vendors (6)

Products (10)

Tools (3)

Industries (4)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.