GitHub Advisoryadvisory · PyPI

GHSA-m9mp-6x32-5rhg scio is vunerable to Remote Command Execution through PyTorch

CRITICAL Published 2025-10-09 Modified 2025-10-09 Official page ↗
Ecosystem
PyPI
Packages
scio-pypi
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-502
Reviewed
2025-10-09

Affected packages

• PyPI scio-pypi: <= 1.0.0 (no fix yet)

Description

Impact PyTorch reported a critical vulnerability when using `torch.load`, even with option `weights_only=True`, for `torch = 2.6`, starting from `scio >= 1.0.1` (currently in dev state). Workarounds You can manually check that you are using `torch >= 2.6`.

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References