Overview

Two critical vulnerabilities are affecting PyTorch and Wazuh. Exploitation of these vulnerabilities may allow an attacker to execute remote code.

Description

PyTorch and Wazuh are affected by vulnerabilities tracked as CVE-2025-24357 and CVE-2025-24016 with CVSS scores of 9.8 and 9.9. The vulnerability results from an attempt by the attacker to inject an unsanitized dictionary in DAPI request/response, where they can forge an unhandled exception (__unhandled_exc__) to evaluate arbitrary Python code. Upon successful exploitation, the vulnerabilities allow attackers to achieve remote code execution on Wazuh servers.

Impact

Successful exploitation of these vulnerabilities may allow the attackers to take control of the affected system.

Solution

PyTorch and Wazuh have released security patches for these vulnerabilities. Users and administrators are encouraged to apply necessary updates.

References

• 1. https://github.com/advisories/GHSA-ggpf-24jw-3fcw
• 2. https://github.com/advisories/GHSA-hcrc-79hj-m3qh