scio is vunerable to Remote Command Execution through PyTorch

CRITICALGHSA-m9mp-6x32-5rhg · Published 09/10/2025 · updated 09/10/2025

In short

Package	Affected versions	Patched versions
scio-pypi PyPI	`≤ 1.0.0`	No fix yet

PyTorch reported a critical vulnerability when using torch.load, even with option weights_only=True, for torch <= 2.5.1.

In scio <= 1.0.0, the lower bound for torch is 2.3.

The lower bound was changed to torch >= 2.6, starting from scio >= 1.0.1 (currently in dev state).

You can manually check that you are using torch >= 2.6.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.