CVE-2026-6878 Details

A vulnerability allowing arbitrary code execution has been identified in ByteDance's verl framework, specifically in versions through 0.7.0. The issue arises in the math answer grading module, within the 'math_equal' function of 'prime_math/grader.py'. The vulnerability is triggered when the ground truth answer is a matrix type and the model's response is formatted as a list. In such cases, the function improperly uses Python's 'eval()' to execute the model's output without any sanitization or sandboxing. This flaw can be exploited remotely, and an exploit is publicly available.

Replace the 'eval()' calls in the vulnerable 'math_equal' function with 'ast.literal_eval()', which safely parses Python literals without executing code. Additionally, conduct a global audit of all 'eval()' and 'exec()' calls in the codebase to identify and replace unsafe usages.