CVE-2025-4742CWE-20CWE-502

XU-YIJIE grpo-flat grpo_vanilla.py main deserialization

Medium · published May 16, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of the file grpo_vanilla.py. The manipulation leads to deserialization. Local access is required to approach this attack. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00206 · 10.1th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2025-05-16T03:00Z
EPSS history
Timeline
  • 16 MAY 03:00Z
    XU-YIJIE grpo-flat grpo_vanilla.py main deserialization
    cvelistv5