PT-2026-22736 · Unknown · Step-Video-T2V

Published 2026-03-03 · Updated 2026-03-12 · CVE-2025-57622

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Step-Video-T2V (affected versions not specified)

Description An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code. The issue is related to the /vae-api and /caption-api endpoints, specifically through the pickle.loads(request.get data()) component. The request.get data() function retrieves data sent by a client, and pickle.loads() deserializes this data. Deserializing untrusted data with pickle.loads() can lead to arbitrary code execution if the pickled data is maliciously crafted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-57622

Affected Products

Step-Video-T2V

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-57622 · Security Note
• https://github.com/stepfun-ai/Step-Video-T2V/issues/65 · Note
• https://github.com/stepfun-ai/Step-Video-T2V/blob/main/api/call_remote_server.py · Note
• https://twitter.com/infoflowcloud/status/2028850882792579343 · Twitter Post
• https://t.me/cveNotify/155310 · Telegram Post
• https://t.me/CVEtracker/46204 · Telegram Post
• https://twitter.com/CVEnew/status/2028849472999235781 · Twitter Post