Xorbits Xoscar through version 0.11.2 contains a flaw that allows an attacker to send specially crafted data over the actor‑pool TCP channel, which is deserialized by cloudpickle.loads without prior validation. The raw pickle stream triggers a __reduce__ gadget that is executed immediately, giving the attacker full control of the server process. Because the server typically runs as root on GPU nodes, the attacker can modify system files, exfiltrate data, or establish persistence, leading to complete compromise of the affected host. The weakness is a classic deserialization of untrusted data, identified as CWE‑502.

One product is impacted: Xorbits Xoscar by xorbitsai, version 0.11.2. No other versions are listed, so only installations of this specific release are vulnerable if they expose the actor‑pool TCP channel.

The vulnerability has a high severity score of 9.3 according to the CVSS evaluation, indicating a full exploitation scope with no pre‑authentication needed. The EPSS probability is less than 1 %, showing that known exploit attempts are rare, and the flaw is not recorded in the CISA KEV catalog, reducing the likelihood of widespread use. However, the remote nature of the exploit means that any host exposing the TCP channel can be targeted. Attackers would need the ability to open a connection to the actor‑pool port and send a malicious pickle payload. Upon success, code execution is obtained at the server process level, potentially as root.