CVE-2025-54413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-54413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54413
Aliases
Related
Published
2025-07-26T03:29:43.716Z
Modified
2026-04-10T05:30:37.147705Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
skops' MethodNode can access unexpected object fields through dot notation, leading to arbitrary code execution at load time
Details

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsistency in MethodNode, which can be exploited to access unexpected object fields through dot notation. This can be used to achieve arbitrary code execution at load time. While this issue may seem similar to GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types. This is fixed in version 12.0.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54413.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-351"
    ]
}
References

Affected packages

Git / github.com/skops-dev/skops

Affected ranges

Type
GIT
Repo
https://github.com/skops-dev/skops
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0aeca055509dfb48c1506870aabdd9e247adf603
Type
GIT
Repo
https://github.com/skops-dev/skops
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ab61439ba35bef6bb24109966e4ed19f08446f82

Affected versions

v0.*
v0.8.0

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "dot"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54413.json"