7 matches found
CVE-2025-54412
A flaw was found in skops. An inconsistency in OperatorFuncNode can hide the execution of untrusted operator methods when a specially crafted model file is loaded. This issue allows arbitrary code execution at load time...
CVE-2025-54412
skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistency in the OperatorFuncNode which can be exploited to hide the execution of untrusted operator methods. This can then be used in a code reuse attack to invoke...
CVE-2025-54412
Skops (Python) CVE-2025-54412 involves an inconsistency in OperatorFuncNode validation that can let an attacker craft a model file which, while appearing to trust certain types, actually executes operator.call and arbitrary code during load. Affected versions: 0.11.0 and earlier; fixed in 0.12.0....
CVE-2025-54412 skops' Inconsistent Trusted Type Validation Enables Hidden `operator` Methods Execution
skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistency in the OperatorFuncNode which can be exploited to hide the execution of untrusted operator methods. This can then be used in a code reuse attack to invoke...
CVE-2025-54412 skops' Inconsistent Trusted Type Validation Enables Hidden `operator` Methods Execution
skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistency in the OperatorFuncNode which can be exploited to hide the execution of untrusted operator methods. This can then be used in a code reuse attack to invoke...
CVE-2025-54412 skops' Inconsistent Trusted Type Validation Enables Hidden `operator` Methods Execution
skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistency in the OperatorFuncNode which can be exploited to hide the execution of untrusted operator methods. This can then be used in a code reuse attack to invoke...
CVE-2025-54412
creationtimestamp| type| source ---|---|--- 2025-07-25 16:58:06+00:00| published-proof-of-concept| https://github.com/skops-dev/skops/security/advisories/GHSA-m7f4-hrc6-fwg3 2025-07-27 02:27:52+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3luvzpzsgxn2k...