PT-2026-1002 · Feast Dev · Feast

Published 2026-01-01 · Updated 2026-01-01 · CVE-2025-11157

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions feast-dev/feast version 0.53.0

Description A high-severity remote code execution issue exists in the Kubernetes materializer job located at feast/sdk/python/feast/infra/compute engines/kubernetes/main.py. The problem stems from using yaml.load(..., Loader=yaml.Loader) to deserialize /var/feast/feature store.yaml and /var/feast/materialization config.yaml. This allows for the instantiation of arbitrary Python objects, potentially enabling an attacker who can modify these YAML files to execute OS commands on the worker pod. Exploitation occurs before configuration validation, which could lead to cluster takeover, data poisoning, and supply-chain sabotage.

Recommendations Versions prior to 0.53.0 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-11157

GHSA-34WM-4HW7-QFJV

Affected Products

Feast

References · 11

• https://osv.dev/vulnerability/CVE-2025-11157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11157 · Security Note
• https://osv.dev/vulnerability/GHSA-34wm-4hw7-qfjv · Vendor Advisory
• https://github.com/feast-dev/feast/commit/b2e37ff37953b68ae833f6874ab5bc510a4ca5fb · Note
• https://github.com/feast-dev/feast · Note
• https://github.com/feast-dev/feast/pull/5643 · Note
• https://twitter.com/CVEnew/status/2006736801806041493 · Twitter Post
• https://t.me/cveNotify/147431 · Telegram Post
• https://t.me/CVEtracker/41171 · Telegram Post
• https://huntr.com/bounties/46d4d585-b968-4a76-80ce-872bc5525564 · Note
• https://twitter.com/VulmonFeeds/status/2006699164294390228 · Twitter Post