PT-2025-4790 · Cvat+1 · Cvat+1

Speclad · Published 2025-01-28 · Updated 2025-09-16 · CVE-2025-23045

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Computer Vision Annotation Tool (CVAT) versions prior to 2.26.0

Description The issue allows an attacker with an account on an affected CVAT instance to run arbitrary code in the context of the Nuclio function container. This affects CVAT deployments that run serverless functions of type tracker from the CVAT Git repository, such as TransT and SiamMask. Deployments with custom functions of type tracker may also be affected if they use an unsafe serialization library like pickle or jsonpickle.

Recommendations Upgrade to CVAT 2.26.0 or later. If you are unable to upgrade, shut down any instances of the TransT or SiamMask functions you're running.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-23045

GHSA-WQ36-MXF8-HV62

Affected Products

Cvat

Nuclio

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23045.json · Exploit
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-wq36-mxf8-hv62 · Vendor Advisory
• https://github.com/cvat-ai/cvat/commit/563e1dfde64b15fa042b23f9d09cd854b35f0366 · Patch
• https://osv.dev/vulnerability/CVE-2025-23045 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23045 · Security Note
• https://t.me/cvedetector/16611 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1884295301042737601 · Twitter Post
• https://t.me/cveNotify/135566 · Telegram Post
• https://twitter.com/CVEnew/status/1884263020261454254 · Twitter Post
• https://twitter.com/CveFindCom/status/1884263218756886801 · Twitter Post
• https://t.me/latest_high_impact_cve/1779 · Telegram Post