Executive brief
PySyft, a library for secure and private data science, is vulnerable to a flaw that allows users to run unauthorized code on the server. While the system has a process for approving code, it fails to check if that code contains malicious commands like deleting files or stealing data. If an attacker's code is approved, they can take full control of the server, potentially exposing sensitive research data or disrupting operations.
Technical details
PySyft (Syft Datasite/Server) versions 0.9.5 and earlier contain a remote code execution vulnerability classified as CWE-94 (Improper Control of Generation of Code). The vulnerability exists because the system allows users to submit Python functions via the @sy.syft_function() decorator for remote execution without performing security validation or sandboxing. Although a manual code approval workflow is in place, the approved code is executed using dangerous functions like exec() and eval() within the main server process. An attacker can bypass the intended restrictions to perform file system operations or execute OS commands, leading to a complete compromise of the server environment. As of the advisory date, no patched version has been identified.
Affected products
- OpenMined syft <= 0.9.5
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: GitHub Advisory published
- 2026-05-18: other: Advisory reviewed and updated