CVE-2026-6878
2 advisories.
PyPI/verl CVE-2026-6878: medium 5.6
verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.7.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-h57c-v2v3-5v3v
- https://nvd.nist.gov/vuln/detail/CVE-2026-6878
- https://github.com/verl-project/verl
- https://github.com/verl-project/verl/blob/v0.7.1/verl/utils/reward_score/prime_math/grader.py
- https://github.com/zast-ai/vulnerability-reports/blob/main/bytedance/verl_rce.md
- https://vuldb.com/submit/795257
- https://vuldb.com/vuln/359040
- https://vuldb.com/vuln/359040/cti
CVE-2026-6878 · published · modified · JSON
PyPI/verl CVE-2026-6878: medium 5.6
verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.7.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-3402
- https://nvd.nist.gov/vuln/detail/CVE-2026-6878
- https://github.com/verl-project/verl
- https://github.com/verl-project/verl/blob/v0.7.1/verl/utils/reward_score/prime_math/grader.py
- https://github.com/zast-ai/vulnerability-reports/blob/main/bytedance/verl_rce.md
- https://vuldb.com/submit/795257
- https://vuldb.com/vuln/359040
- https://vuldb.com/vuln/359040/cti
- https://pypi.org/project/verl
- https://github.com/advisories/GHSA-h57c-v2v3-5v3v
CVE-2026-6878 · published · modified · JSON