CVE-2025-70560

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-70560
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-70560.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-70560
Aliases
Published
2026-02-03T00:00:00Z
Modified
2026-08-12T03:51:36Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70560.json"
}
References

Affected packages

Git / github.com/jwohlwend/boltz

Affected ranges

Type
GIT
Repo
https://github.com/jwohlwend/boltz
Events
Introduced
afe4aa657e80bc2974c27b7095bc0ff1091d7150
Last Affected
afe4aa657e80bc2974c27b7095bc0ff1091d7150
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:jwohlwend:boltz:2.0.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*
2.0.0
v2.*
v2.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-70560.json"