GHSA-8cm9-rrgc-4pcj

Cleanlab Deserialization of Untrusted Data vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-45857

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	cleanlab	>= 2.4.0, <= 2.6.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-45857 advisory
https://github.com/cleanlab/cleanlab package
https://github.com/cleanlab/cleanlab/blob/v2.6.6/cleanlab/datalab/internal/serialize.py#L102-L138 web
https://hiddenlayer.com/sai-security-advisory/2024-09-cleanlab web