# CVE-2024-10190: Horovod Vulnerable to Command Injection

Source: https://junglewise.ai/threats/cve-2024-10190-horovod-vulnerable-to-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-20  
License: CC BY 4.0 with a link back

CVE-2024-10190 · Severity: critical · CVSS 9.8 · Published 2025-03-20

Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.

Technologies: [horovod (PyPI)](https://junglewise.ai/threats/technologies/pypi-horovod). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-10190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-10190 being exploited in the wild.

**How severe is CVE-2024-10190?** Critical severity, with a CVSS score of 9.8, published 20 March 2025.

**Which products and versions are affected?** horovod (PyPI) <= 0.28.1, ECOSYSTEM:introduced=0,last_affected=0.28.1.

**Is there a fix for CVE-2024-10190?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2024-10190?** Check whether you run horovod (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- horovod (PyPI) <= 0.28.1, ECOSYSTEM:introduced=0,last_affected=0.28.1

## Identifiers

- CVE-2024-10190
- GHSA-mrhh-3ggq-23p2
- PYSEC-2026-355

## Related threats

- [Horovod insecure deserialization in KVStore HTTP server](https://junglewise.ai/threats/cve-2026-31234-horovod-insecure-deserialization-in-kvstore-http-server)
- [PYSEC-2022-175 - Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.](https://junglewise.ai/threats/cve-2022-0315-use-of-insecure-temporary-file-in-horovod)