# 1 High-Security vulnerability found in Black Duck scan **URL:** \ **Category:** testing\ **Created:** [October 3, 2024, 1:20am UTC](https://dev-discuss.pytorch.org/t/1-high-security-vulnerability-found-in-black-duck-scan/2509 "2024-10-03T01:20:40Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![doug091](https://yyz2.discourse-cdn.com/flex036/user_avatar/dev-discuss.pytorch.org/doug091/32/2314_2.png) [@doug091](https://dev-discuss.pytorch.org/u/doug091)\ **Post date:** [October 3, 2024, 1:20am UTC](https://dev-discuss.pytorch.org/t/1-high-security-vulnerability-found-in-black-duck-scan/2509/1 "2024-10-03T01:20:40Z")
Hello! I’m using PyTorch on a project that uses pre-trained AI models. The previous version was 2.2.2, so I updated to version 2.4.1 (current) due to the Black Duck scan reporting that the library was a high-security risk, due to a vulnerability found in the software. Even with the update, the vulnerability still exists. " Description PyTorch is vulnerable to remote code execution (RCE) via command injection within the `torch.distributed.rpc` framework. An attacker could exploit this in order to remotely attack master nodes that are starting distributed training." Is there any action that can be taken to mitigate this security vulnerability? ---
**Author:** ![malfet](https://yyz2.discourse-cdn.com/flex036/user_avatar/dev-discuss.pytorch.org/malfet/32/129_2.png) [@malfet](https://dev-discuss.pytorch.org/u/malfet)\ **Post date:** [October 3, 2024, 3:26pm UTC](https://dev-discuss.pytorch.org/t/1-high-security-vulnerability-found-in-black-duck-scan/2509/2 "2024-10-03T15:26:12Z")
> [@doug091](#): > > PyTorch is vulnerable to remote code execution (RCE) via command injection within the `torch.distributed.rpc` framework. An attacker could exploit this in order to remotely attack master nodes that are starting distributed training Do you have a CVE number by any chance? I’ve found [NVD - CVE-2024-5480](https://nvd.nist.gov/vuln/detail/CVE-2024-5480) which were rejected, may be due to [pytorch/SECURITY.md at main · pytorch/pytorch · GitHub](https://github.com/pytorch/pytorch/blob/main/SECURITY.md#using-distributed-features) (i.e. PyTorch is vulnerable on RCE only if one uses distribtued features, which should only be used in trusted environment) ---
**Author:** ![doug091](https://yyz2.discourse-cdn.com/flex036/user_avatar/dev-discuss.pytorch.org/doug091/32/2314_2.png) [@doug091](https://dev-discuss.pytorch.org/u/doug091)\ **Post date:** [October 3, 2024, 4:09pm UTC](https://dev-discuss.pytorch.org/t/1-high-security-vulnerability-found-in-black-duck-scan/2509/3 "2024-10-03T16:09:35Z")
Hi malfet, It is exactly this CVE that Black Duck is complaining about, but the related code is from the software itself BDSA-2024-3458. [Black Duck scan full report](https://github.com/doug091/ftp_temp/blob/main/BlackDuck-BDSA-2024-3458-related-CVE-2024-5480.pdf) ---
**Author:** ![smth](https://yyz2.discourse-cdn.com/flex036/user_avatar/dev-discuss.pytorch.org/smth/32/3_2.png) [@smth](https://dev-discuss.pytorch.org/u/smth)\ **Post date:** [October 3, 2024, 4:25pm UTC](https://dev-discuss.pytorch.org/t/1-high-security-vulnerability-found-in-black-duck-scan/2509/4 "2024-10-03T16:25:55Z")
as Nikita mentioned, torch.distributed features should only be used in a trusted environment (as covered in SECURITY.md), so while Black Duck is doing its job, if you are in a trusted environment, you can just use it as-is. ---
**Author:** ![doug091](https://yyz2.discourse-cdn.com/flex036/user_avatar/dev-discuss.pytorch.org/doug091/32/2314_2.png) [@doug091](https://dev-discuss.pytorch.org/u/doug091)\ **Post date:** [October 3, 2024, 6:09pm UTC](https://dev-discuss.pytorch.org/t/1-high-security-vulnerability-found-in-black-duck-scan/2509/5 "2024-10-03T18:09:30Z")
Indeed. I added a comment mentioning this discussion and the SECURITY.md to the code alert and the Black Duck Rollout team removed the security risk flag from the PyTorch package. Thanks!