CVE-2025-3165 — Vulnetix

Try Vulnetix Request Demo

CVE-2025-3165 PUBLISHED CVSS 4.800000190734863 MEDIUM

A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The manipulation of the argument ckpt_path/quant_ckpt_dir leads to deserialization. An attack has to be approached locally.

EPSS 0.13% · 32.1th percentile

Risk Scores

CVSS v4.0

4.800000190734863

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS Score

0.13%

32.1th percentile

Affected Products

Vendor	Product	Versions
thu-pacman	chitu	0.1.0

Timeline

Apr 3, 2025 CVE Published
Apr 3, 2025 PoC Published
Apr 3, 2025 PoC Published
Apr 4, 2025 EPSS Score
Apr 16, 2025 EPSS Score
Apr 28, 2025 EPSS Score
May 11, 2025 EPSS Score
May 23, 2025 EPSS Score
Jun 4, 2025 EPSS Score
Jun 16, 2025 EPSS Score
Jun 29, 2025 EPSS Score
Jul 11, 2025 EPSS Score

References

VDB-303111 | thu-pacman chitu backend.py torch.load deserialization vdb
VDB-303111 | CTI Indicators (IOB, IOC, IOA) url
Submit #542529 | thu-pacman chitu <0.1.0 Deserialization third-party-advisory
https://github.com/thu-pacman/chitu/issues/32 issue
https://nvd.nist.gov/vuln/detail/CVE-2025-3165 advisory

Open in Interactive Console →