Description
A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
References (4)
Core 4
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-359040 | ByteDance verl grader.py math_equal sandbox
https://vuldb.com/vuln/359040
Signature, Permissions Required signature
permissions-required
VDB-359040 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/359040/cti
Third Party Advisory third-party-advisory
Submit #795257 | Bytedance verl <=0.7.0 Arbitrary Code Execution
https://vuldb.com/submit/795257
Scores
CVSS v3
5.6
EPSS
0.0033
EPSS Percentile
25.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-264
CWE-265
Status
published
Products (8)
ByteDance/verl
0.1
ByteDance/verl
0.2
ByteDance/verl
0.3
ByteDance/verl
0.4
ByteDance/verl
0.5
ByteDance/verl
0.6
ByteDance/verl
0.7.0
pypi/verl
0PyPI
Published
Apr 23, 2026
Tracked Since
Apr 23, 2026