Open-source package vulnerability · PyPI

GHSA-m9mp-6x32-5rhg: scio is vunerable to Remote Command Execution through PyTorch

criticalCVSS 4.0 9.3

Impact PyTorch reported a critical vulnerability when using torch.load, even with option weightsonly=True, for torch = 2.6, starting from scio = 1.0.1 (currently in dev state). Workarounds You can manually check that you are using torch = 2.6.

Published Oct 9, 2025

Affected packages

scio-pypi

Ecosystem: PyPI
Affected: <= 1.0.0
Fixed in: No patched version yet
Check: pip show scio-pypi

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

PyTorch reported a **critical** vulnerability when using torch.load, even with option weights_only=True, for torch <= 2.5.1.

In scio <= 1.0.0, the lower bound for torch is 2.3.

Patches

The lower bound was changed to torch >= 2.6, starting from scio >= 1.0.1 (currently in dev state).

Workarounds

You can manually check that you are using torch >= 2.6.

Credited to eliegoudout.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology