Tencent HunyuanDiT Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Tencent HunyuanDiT. This issue arises from the merge endpoint's improper validation of user-supplied data, allowing for the deserialization of untrusted data. As a result, remote attackers can execute arbitrary code on affected installations, with the execution occurring in the context of root. Exploitation of this vulnerability requires user interaction, as the target must visit a malicious page or open a malicious file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running as the root user.

Remediation

Tencent has released a patch for this vulnerability. Users can update to the latest version of HunyuanDiT to address this issue.