EUVD-2026-25146
GHSA-h57c-v2v3-5v3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker identifies verl service endpoint
-
DeliveryCrafts specialized payload targeting math_equal function
-
ExploitSends request exploiting sandbox validation gap
-
ExecutionReceives information disclosure response
-
ImpactExtracts sensitive internal state
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | The vulnerability requires that ByteDance verl is exposed to network access with the math_equal function in prime_math/grader.py reachable via the attack vector. There are no indications the vulnerability requires special configuration, non-default settings, or specific feature enablement-the affected versions 0.1 through 0.7.0 are vulnerable by default. The high attack complexity (AC:H) imposes a practical limitation: the attacker must craft input that precisely triggers the sandbox bypass, making opportunistic or automated exploitation difficult. Authentication is not required (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to remote network-accessible instances; local or unexposed deployments are not at risk from this specific vector. |
| Impact | The CVSS 4.0 vector indicates remote network access (AV:N) with high attack complexity (AC:H), unauthenticated exploitation (PR:N), and no user interaction required (UI:N). The impact is limited to confidentiality (VC:L/VI:L/VA:L) with low severity across all impact categories. The EPSS score is not provided, but the 'P' exploitation maturity (E:P) combined with publicly available POC code indicates this is not theoretical-real-world exploitation tooling exists. The high attack complexity (AC:H) and limited impact scope create a risk profile lower than the CVSS 6.3 numeric score alone suggests; this is a targeted information disclosure rather than critical system compromise. The vendor's non-response to early disclosure is a negative signal for patch availability, increasing reliance on user-side mitigation. |
| Exploit ScenarioDerived | An attacker sends a specially crafted remote request to a service running ByteDance verl, targeting the math_equal function with manipulated input parameters designed to bypass sandbox restrictions. The high attack complexity suggests the attacker must precisely craft the payload to trigger the vulnerable code path, but once successful, they can extract limited information from the evaluation context, such as internal variable states or computation results not intended for external consumption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 23, 2026
Sandbox bypass in ByteDance verl up to version 0.7.0 allows remote attackers to achieve limited information disclosure through manipulation of the math_equal function in prime_math/grader.py. The vulnerability requires high attack complexity and has been publicly documented with exploit code available, though the vendor has not responded to early disclosure attempts.
RemediationAI
No vendor-released patch has been identified at time of analysis due to the vendor's non-response to disclosure. Users should immediately upgrade to a version newer than 0.7.0 if one becomes available; however, the absence of vendor communication means current deployments cannot rely on an official security release. As compensating controls, restrict network access to verl evaluation endpoints using firewall rules or API gateway authentication to limit remote attack surface, isolate verl services into separate network segments to contain potential information leakage, and disable or restrict access to the math_equal function in prime_math/grader.py if not critical to your use case (document functional impact before disabling). Monitor for unusual access patterns to grader.py or unexpected outputs from mathematical evaluation functions. Consider forking verl and applying a patch that adds input validation to the math_equal function, or switch to alternative machine learning training frameworks with more active security governance if this vulnerability blocks your deployment timeline.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the math_equal function within the prime_math/grader.py module of ByteDance verl, a machine learning training framework. The root cause is classified under CWE-265 (Improper Privilege Management / Insecure Direct Object References), indicating insufficient validation or authorization checks in the sandboxed evaluation context. The vulnerability allows circumvention of sandbox protections designed to safely evaluate mathematical expressions, potentially exposing internal state or computation results. The affected versions span from 0.1 through 0.7.0, suggesting the vulnerability has existed since early releases.
Know when Verl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB