~ / search / GHSA-q49c-6v6g-wgq3

GHSA-q49c-6v6g-wgq3

Skops unsafe deserialization

Source: GitHub Advisory Database (reviewed) High CVE-2024-37065

Packages

EcosystemPackageAffectedFixed in
PyPI skops >= 0.6, <= 0.9 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded.

References

External links from the advisory. They lead to third-party sites.