CVE-2025-45146
📋 TL;DR
CVE-2025-45146 is a critical deserialization vulnerability in ModelCache for LLM that allows remote code execution by sending specially crafted data to the data_manager.py component. This affects all users of ModelCache versions up to v0.2.0 who expose the vulnerable component. Attackers can exploit this to take complete control of affected systems.
💻 Affected Systems
- ModelCache for LLM
📦 What is this software?
Modelcache by Codefuse
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, lateral movement within networks, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to run arbitrary commands, steal sensitive data, and use the system as a foothold for further attacks.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting isolated components.
🎯 Exploit Status
The vulnerability is in deserialization logic which typically has well-known exploitation patterns. No public PoC found in references but exploitation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Monitor the official ModelCache repository for security updates. 2. Apply any available patches immediately. 3. Restart affected services after patching.
🔧 Temporary Workarounds
Disable vulnerable component
allRemove or disable access to the data_manager.py component if not essential
# Identify and stop services using modelcache/manager/data_manager.py
# Remove or rename the vulnerable file if possible
Network isolation
linuxRestrict network access to ModelCache services
# Use firewall rules to limit access to ModelCache ports
# Example: iptables -A INPUT -p tcp --dport [MODELCACHE_PORT] -s [TRUSTED_IPS] -j ACCEPT
# iptables -A INPUT -p tcp --dport [MODELCACHE_PORT] -j DROP
🧯 If You Can't Patch
- Isolate affected systems in a restricted network segment with no internet access
- Implement strict input validation and sanitization for all data processed by ModelCache
🔍 How to Verify
Check if Vulnerable:
Check if ModelCache version is ≤0.2.0 and if data_manager.py is being used for deserialization operationsCheck Version:
pip show modelcache | grep VersionVerify Fix Applied:
Verify ModelCache version is >0.2.0 after official patch release and test deserialization functionality📡 Detection & Monitoring
Log Indicators:
- Unusual deserialization errors
- Suspicious process creation from ModelCache
- Unexpected network connections from ModelCache processes
Network Indicators:
- Unusual outbound connections from ModelCache hosts
- Traffic to known malicious IPs from ModelCache systems
SIEM Query:
source="modelcache" AND (event_type="deserialization" OR process_name="python" AND cmdline="*data_manager*")🔗 References
- https://github.com/EDMPL/Vulnerability-Research/blob/main/CVE-2025-45146/README.md
- https://github.com/codefuse-ai/ModelCache/blob/e053e0d57b532d4ad9378d2f31bb85a009b77d64/modelcache/manager/data_manager.py#L84C1-L84C43
- https://github.com/codefuse-ai/ModelCache/blob/e053e0d57b532d4ad9378d2f31bb85a009b77d64/modelcache/manager/factory.py#L18C1-L18C71
- https://pytorch.org/docs/stable/generated/torch.load.html
