PT-2025-30944 · Skops · Skops

Io-No · Published 2025-07-25 · Updated 2025-07-26 · CVE-2025-54413

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions skops versions 0.11.0 and below skops versions prior to 12.0.0

Description skops is a Python library used for sharing and shipping scikit-learn based models. A vulnerability exists due to an inconsistency in the MethodNode component, allowing access to unexpected object fields through dot notation. This can be exploited to achieve arbitrary code execution at load time. The vulnerability bypasses untrusted type detection mechanisms by chaining multiple MethodNode instances to traverse the Python object hierarchy and access dangerous components, such as the builtins dictionary. The MethodNode allows access to attributes of existing objects via dot notation without proper checks, enabling access to dangerous attributes and methods.

Recommendations skops versions prior to 12.0.0 are vulnerable. Update to skops version 12.0.0 or later to resolve this issue.

Exploit

Fix

Weakness Enumeration

CWE-351

Related Identifiers

CVE-2025-54413

GHSA-4V6W-XPMH-GFGP

GHSA-M7F4-HRC6-FWG3

Affected Products

Skops

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54413.json · Exploit
• 🔥 https://github.com/io-no/CVE-Reports/tree/main/CVE-2025-54413 · Exploit
• 🔥 https://github.com/io-no/CVE-Reports/tree/main/CVE-2025-54412 · Exploit
• https://osv.dev/vulnerability/GHSA-4v6w-xpmh-gfgp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54413 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m7f4-hrc6-fwg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54413 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-54412 · Security Note
• https://github.com/skops-dev/skops/security/advisories/GHSA-m7f4-hrc6-fwg3 · Note
• https://github.com/skops-dev/skops/releases/tag/v0.12.0 · Note
• https://github.com/skops-dev/skops/security/advisories/GHSA-4v6w-xpmh-gfgp · Note
• https://github.com/skops-dev/skops/commit/0aeca055509dfb48c1506870aabdd9e247adf603 · Note
• https://github.com/skops-dev/skops · Note
• https://twitter.com/CveFindCom/status/1948959236932653474 · Twitter Post
• https://twitter.com/CVEnew/status/1948976648398700823 · Twitter Post