Vulnerability · Published May 16, 2025 · Assigned by VulDB

CVE-2025-4742XU-YIJIE grpo-flat grpo_vanilla.py main deserialization

Medium 5.3

In plain English

A medium-severity unsafe deserialization in grpo-flat from XU-YIJIE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 89.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of the file grpo_vanilla.py. The manipulation leads to deserialization. Local access is required to approach this attack. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Affected products (as reported)

Vendor	Product	Versions
XU-YIJIE	grpo-flat	9024b43f091e2eb9bac65802b120c0b35f9ba856

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-309042 | XU-YIJIE grpo-flat grpo_vanilla.py main deserialization vdb-entry, technical-description
VDB-309042 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #570923 | XU-YIJIE grpo-flat 0.0 Deserialization third-party-advisory
https://github.com/XU-YIJIE/grpo-flat/issues/3 issue-tracking