PT-2025-21600 · Xu Yijie · Grpo-Flat

Ybdesire · Published 2025-05-16 · Updated 2025-05-16 · CVE-2025-4742

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856

Description: A vulnerability has been found in the function main of the file grpo vanilla.py. The manipulation leads to deserialization. Local access is required to approach this attack. The product uses continuous delivery with rolling releases, so no version details of affected or updated releases are available.

Recommendations: For XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856, as a temporary workaround, consider restricting access to the main function in the grpo vanilla.py file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-4742

Affected Products

Grpo-Flat

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-4742 · Security Note
• https://github.com/XU-YIJIE/grpo-flat/issues/3 · Note
• https://t.me/cvetracker/23981 · Telegram Post
• https://vuldb.com/?ctiid.309042 · Note
• https://vuldb.com/?submit.570923 · Note
• https://twitter.com/CVEnew/status/1923235053540098539 · Twitter Post
• https://vuldb.com/?id.309042 · Note
• https://t.me/cvenotify/122473 · Telegram Post