CVE-2024-37065 HIGH

CVE-2024-37065

Vendor Skops-Dev

Product Skops

Weakness CWE-502 · Unsafe deserialization

Published June 4, 2024

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

7.8/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded.

Key dates

02Disclosure timeline

June 4, 2024 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-37065 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html

Related vulnerabilities

04Related CVE

CVE-2026-1839 Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers CVE-2020-36726 Ultimate Reviews < 2.1.33 - PHP Object Injection CVE-2021-25642 Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler CVE-2026-25032 WordPress Ricky theme < 2.31 - PHP Object Injection vulnerability CVE-2024-13163