GHSA-mrhh-3ggq-23p2 · Severity: critical · Ecosystem: pip — Horovod Vulnerable to Command Injection
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
Conclusion & alert: CVE-2024-10190 is rated High Exploit Risk (80.2/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 1.05%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-02 | 2.26% | 1.05% | -1.21% |
| 2 | 2026-04-30 | 2.09% | 2.26% | +0.17% |
| 3 | 2026-04-28 | — | 2.09% | — |
Full EPSS history (25 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.0 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-mrhh-3ggq-23p2 · Severity: critical · Ecosystem: pip — Horovod Vulnerable to Command Injection
| URL | Tags |
|---|---|
| https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754 | Exploit Issue Tracking Third Party Advisory |