CVE-2025-50461: A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/model_merger.py script wh

Volcengine's verl 3.0.0 has a deserialization vulnerability (unsafe loading of data structures from untrusted files) in its model_merger.py script that uses torch.load() with weights_only=False, allowing attackers to execute arbitrary code (run commands without authorization) if a victim loads a malicious model file. An attacker can exploit this by tricking a user into downloading and using a specially crafted .pt file, potentially gaining full control of the victim's system.