Cybersecurity researchers have uncovered vital distant code execution vulnerabilities impacting main synthetic intelligence (AI) inference engines, together with these from Meta, Nvidia, Microsoft, and open-source PyTorch initiatives corresponding to vLLM and SGLang.
“These vulnerabilities all traced again to the identical root trigger: the ignored unsafe use of ZeroMQ (ZMQ) and Python’s pickle deserialization,” Oligo Safety researcher Avi Lumelsky mentioned in a report revealed Thursday.
At its core, the problem stems from what has been described as a sample known as ShadowMQ, through which the insecure deserialization logic has propagated to a number of initiatives on account of code reuse.
The basis trigger is a vulnerability in Meta’s Llama giant language mannequin (LLM) framework (CVE-2024-50050, CVSS rating: 6.3/9.3) that was patched by the corporate final October. Particularly, it concerned the usage of ZeroMQ’s recv_pyobj() technique to deserialize incoming knowledge utilizing Python’s pickle module.
This, coupled with the truth that the framework uncovered the ZeroMQ socket over the community, opened the door to a situation the place an attacker can execute arbitrary code by sending malicious knowledge for deserialization. The difficulty has additionally been addressed within the pyzmq Python library.
Oligo has since found the identical sample recurring in different inference frameworks, corresponding to NVIDIA TensorRT-LLM, Microsoft Sarathi-Serve, Modular Max Server, vLLM, and SGLang.
“All contained almost an identical unsafe patterns: pickle deserialization over unauthenticated ZMQ TCP sockets,” Lumelsky mentioned. “Completely different maintainers and initiatives maintained by totally different corporations – all made the identical mistake.”
Tracing the origins of the issue, Oligo discovered that in not less than just a few circumstances, it was the results of a direct copy-paste of code. For instance, the susceptible file in SGLang says it is tailored by vLLM, whereas Modular Max Server has borrowed the identical logic from each vLLM and SGLang, successfully perpetuating the identical flaw throughout codebases.
The problems have been assigned the next identifiers –
CVE-2025-30165 (CVSS rating: 8.0) – vLLM (Whereas the problem isn’t mounted, it has been addressed by switching to the V1 engine by default)
CVE-2025-23254 (CVSS rating: 8.8) – NVIDIA TensorRT-LLM (Mounted in model 0.18.2)
CVE-2025-60455 (CVSS rating: N/A) – Modular Max Server (Mounted)
Sarathi-Serve (Stays unpatched)
SGLang (Carried out incomplete fixes)
With inference engines appearing as an important part inside AI infrastructures, a profitable compromise of a single node might allow an attacker to execute arbitrary code on the cluster, escalate privileges, conduct mannequin theft, and even drop malicious payloads like cryptocurrency miners for monetary acquire.
“Tasks are shifting at unimaginable pace, and it is common to borrow architectural elements from friends,” Lumelsky mentioned. “However when code reuse contains unsafe patterns, the results ripple outward quick.”
The disclosure comes as a brand new report from AI safety platform Knostic has discovered that it is attainable to compromise Cursor’s new built-in browser through JavaScript injection strategies, to not point out leverage a malicious extension to facilitate JavaScript injection to be able to take management of the developer workstation.
The primary assault includes registering a rogue native Mannequin Context Protocol (MCP) server that bypasses Cursor’s controls to permit an attacker to exchange the login pages throughout the browser with a bogus web page that harvests credentials and exfiltrates them to a distant server underneath their management.
“As soon as a person downloaded the MCP server and ran it, utilizing an mcp.json file inside Cursor, it injected code into Cursor’s browser that led the person to a faux login web page, which stole their credentials and despatched them to a distant server,” safety researcher Dor Munis mentioned.
On condition that the AI-powered supply code editor is actually a fork of Visible Studio Code, a foul actor might additionally craft a malicious extension to inject JavaScript into the operating IDE to execute arbitrary actions, together with marking innocent Open VSX extensions as “malicious.”
“JavaScript operating contained in the Node.js interpreter, whether or not launched by an extension, an MCP server, or a poisoned immediate or rule, instantly inherits the IDE’s privileges: full file-system entry, the power to switch or exchange IDE features (together with put in extensions), and the power to persist code that reattaches after a restart,” the corporate mentioned.
“As soon as interpreter-level execution is offered, an attacker can flip the IDE right into a malware distribution and exfiltration platform.”
To counter these dangers, it is important that customers disable Auto-Run options of their IDEs, vet extensions, set up MCP servers from trusted builders and repositories, test what knowledge and APIs the servers entry, use API keys with minimal required permissions, and audit MCP server supply code for vital integrations.
