Every CVE Search/ Get API key

CVE-2025-41419

MS SWIFT WEB-UI RCE Vulnerability

5.1 MediumFix available

I. Detailed Description:

This includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link.

  1. Install ms-swift

    pip install ms-swift -U

  2. Start web-ui

    swift web-ui --lang en

  3. After startup, access through browser at http://localhost:7860/ to see the launched fine-tuning framework program

  4. Fill in necessary parameters In the LLM Training interface, fill in required parameters including Model id, Dataset Code. The --output_dir can be filled arbitrarily as it will be modified later through packet capture

  5. Click Begin to start training. Capture packets and modify the parameter corresponding to --output_dir

    You can see the concatenated command being executed in the terminal where web-ui was started

  6. Wait for the program to run (testing shows it requires at least 5 minutes), and you can observe the effect of command execution creating files

II. Vulnerability Proof (Write POC here):

/tmp/xxx'; touch /tmp/inject_success_1; #

III. Fix Solution:

  1. The swift.ui.llm_train.llm_train.LLMTrain#train() method should not directly concatenate parameters with commands after receiving commands from the frontend
  2. The swift.ui.llm_train.llm_train.LLMTrain#train_local() method should not use os.system for execution, but should be changed to subprocess.run([cmd, arg1, arg2...]) format

Author

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

What each source reports

GitHub Advisories Score usedGHSA-7c78-rm87-5673 5.1

MS SWIFT WEB-UI RCE Vulnerability

I. Detailed Description:

This includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link.

  1. Install ms-swift

    pip install ms-swift -U

  2. Start web-ui

    swift web-ui --lang en

  3. After startup, access through browser at http://localhost:7860/ to see the launched fine-tuning framework program

  4. Fill in necessary parameters In the LLM Training interface, fill in required parameters including Model id, Dataset Code. The --output_dir can be filled arbitrarily as it will be modified later through packet capture

  5. Click Begin to start training. Capture packets and modify the parameter corresponding to --output_dir

    You can see the concatenated command being executed in the terminal where web-ui was started

  6. Wait for the program to run (testing shows it requires at least 5 minutes), and you can observe the effect of command execution creating files

II. Vulnerability Proof (Write POC here):

/tmp/xxx'; touch /tmp/inject_success_1; #

III. Fix Solution:

  1. The swift.ui.llm_train.llm_train.LLMTrain#train() method should not directly concatenate parameters with commands after receiving commands from the frontend
  2. The swift.ui.llm_train.llm_train.LLMTrain#train_local() method should not use os.system for execution, but should be changed to subprocess.run([cmd, arg1, arg2...]) format

Author

Record
GHSA-7c78-rm87-5673
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-117
Updated
2026-11-02
OSVGHSA-7c78-rm87-5673 5.1

MS SWIFT WEB-UI RCE Vulnerability

I. Detailed Description:

This includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link.

  1. Install ms-swift

    pip install ms-swift -U

  2. Start web-ui

    swift web-ui --lang en

  3. After startup, access through browser at http://localhost:7860/ to see the launched fine-tuning framework program

  4. Fill in necessary parameters In the LLM Training interface, fill in required parameters including Model id, Dataset Code. The --output_dir can be filled arbitrarily as it will be modified later through packet capture

  5. Click Begin to start training. Capture packets and modify the parameter corresponding to --output_dir

    You can see the concatenated command being executed in the terminal where web-ui was started

  6. Wait for the program to run (testing shows it requires at least 5 minutes), and you can observe the effect of command execution creating files

II. Vulnerability Proof (Write POC here):

/tmp/xxx'; touch /tmp/inject_success_1; #

III. Fix Solution:

  1. The swift.ui.llm_train.llm_train.LLMTrain#train() method should not directly concatenate parameters with commands after receiving commands from the frontend
  2. The swift.ui.llm_train.llm_train.LLMTrain#train_local() method should not use os.system for execution, but should be changed to subprocess.run([cmd, arg1, arg2...]) format

Author

Record
GHSA-7c78-rm87-5673
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-117
Updated
2026-11-02
OSVPYSEC-2026-1682 5.1

MS SWIFT WEB-UI RCE Vulnerability

I. Detailed Description:

This includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link.

  1. Install ms-swift

    pip install ms-swift -U

  2. Start web-ui

    swift web-ui --lang en

  3. After startup, access through browser at http://localhost:7860/ to see the launched fine-tuning framework program

  4. Fill in necessary parameters In the LLM Training interface, fill in required parameters including Model id, Dataset Code. The --output_dir can be filled arbitrarily as it will be modified later through packet capture

  5. Click Begin to start training. Capture packets and modify the parameter corresponding to --output_dir

    You can see the concatenated command being executed in the terminal where web-ui was started

  6. Wait for the program to run (testing shows it requires at least 5 minutes), and you can observe the effect of command execution creating files

II. Vulnerability Proof (Write POC here):

/tmp/xxx'; touch /tmp/inject_success_1; #

III. Fix Solution:

  1. The swift.ui.llm_train.llm_train.LLMTrain#train() method should not directly concatenate parameters with commands after receiving commands from the frontend
  2. The swift.ui.llm_train.llm_train.LLMTrain#train_local() method should not use os.system for execution, but should be changed to subprocess.run([cmd, arg1, arg2...]) format

Author

Record
PYSEC-2026-1682
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
ms-swift
PyPI
 before 3.7.0
3.7.0
ms-swift
PyPI
 before 3.7.0, plus listed versions
1.0.01.1.01.2.01.2.11.3.0
Show 45 moreShow less
1.4.01.5.01.5.11.5.21.5.31.5.41.6.01.6.11.6.21.6.31.7.01.7.11.7.21.7.32.0.02.0.12.0.22.0.32.0.3.post12.0.42.0.52.0.5.post12.1.02.1.12.1.1.post12.1.1.post22.2.02.2.12.2.22.2.32.2.42.2.52.3.02.3.0.post12.3.12.3.22.3.2.post12.4.02.4.0.post12.4.12.4.22.4.2.post12.4.2.post22.5.0.post12.5.1
3.7.0

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-41419 is a medium vulnerability (CVSS 5.1) in ms-swift, published July 31, 2025. No source lists public exploit code. Fixed in ms-swift 3.7.0.

References

This page doesn't list everything

Left out here: 35 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open