{"id":"CVE-2024-10190","aliases":["GHSA-mrhh-3ggq-23p2","PYSEC-2026-355"],"title":"Horovod Vulnerable to Command Injection","summary":"Horovod Vulnerable to Command Injection","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"horovod","product":"horovod","ecosystem":"pip","affected":["horovod <= 0.28.1"],"published":"2025-03-20","updated":"2026-10-27","sourceUpdated":"2026-10-27T17:30:37.969317003Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mrhh-3ggq-23p2","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10190"},{"url":"https://github.com/horovod/horovod"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/horovod/PYSEC-2026-355.yaml"},{"url":"https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754"},{"url":"https://pypi.org/project/horovod"},{"url":"https://github.com/advisories/GHSA-mrhh-3ggq-23p2"}],"tags":["osv","pip","ghsa"],"epss":0.01124,"epssPercentile":0.66091,"cwe":["CWE-77","CWE-502"],"ingestedAt":"2026-10-27T17:33:23.770Z","slug":"CVE-2024-10190","body":"## Overview\n\nHorovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.\n\n## Affected packages\n\n- `horovod <= 0.28.1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}