GHSA-fjm6-8xp2-4fwc

Source

https://github.com/advisories/GHSA-fjm6-8xp2-4fwc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fjm6-8xp2-4fwc/GHSA-fjm6-8xp2-4fwc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fjm6-8xp2-4fwc

Aliases

CVE-2025-70560

Published

2026-02-03T18:30:47Z

Modified

2026-02-04T20:26:22.065523Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

Details

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.

Database specific

{
    "nvd_published_at": "2026-02-03T18:16:17Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed_at": "2026-02-04T19:43:50Z",
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

PyPI / boltz

Package

Name: boltz; View open source insights on deps.dev
Purl: pkg:pypi/boltz

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.0.0

Affected versions

0.*

0.0.0

0.1.0

0.2.0

0.2.1

0.3.0

0.3.1

0.3.2

0.4.0

0.4.1

1.*

1.0.0

2.*

2.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fjm6-8xp2-4fwc/GHSA-fjm6-8xp2-4fwc.json"