Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks

Cybersecurity researchers have uncovered remote code execution vulnerabilities across major AI inference engines from Meta, Nvidia, Microsoft, and open-source PyTorch projects such as vLLM and SGLang, tracing the flaws to an unsafe pattern dubbed ShadowMQ. The root cause is described as the unsafe deserialization of data via Python’s pickle over ZeroMQ, with multiple projects reproducing nearly identical insecure patterns after code reuse, according to Oligo Security.

The original Meta Llama framework vulnerability (CVE-2024-50050, CVSS 6.3/9.3) involved deserialising data using ZeroMQ’s recv_pyobj() and exposing the socket over the network, enabling arbitrary code execution; it has since been addressed in the pyzmq library.

The issues have been carried into NVIDIA TensorRT-LLM, Microsoft Sarathi-Serve, Modular Max Server, vLLM, and SGLang, with CVEs assigned for some projects: CVE-2025-30165 (CVSS 8.0) to vLLM, CVE-2025-23254 (CVSS 8.8) to NVIDIA TensorRT-LLM, and CVE-2025-60455 (N/A) to Modular Max Server, while Sarathi-Serve remains unpatched and SGLang has implemented only partial fixes.

The researchers warn that compromising a single node could allow code execution, privilege escalation, model theft, or covert deployment of miners, underscoring the risk posed by developers reusing insecure code across ecosystems. The disclosure also notes related browser- and extension-based attack risks in Cursor and associated tooling, emphasising the need to vet MCP servers, disable Auto-Run features, and audit code to mitigate such exploitation.