GHSA-57hm-8rjv-498w

ml-logger deserialization vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2025-10950

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ml-logger	<= 0.10.36	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was determined in geyang ml-logger 0.10.36 and prior. Affected is the function log_handler of the file ml_logger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-10950 advisory
https://github.com/geyang/ml-logger/issues/72 web
https://github.com/geyang/ml-logger package
https://vuldb.com/?ctiid.325820 web
https://vuldb.com/?id.325820 web
https://vuldb.com/?submit.652461 web