CVE-2025-54886 skops: Card.get_model does not block arbitrary code execution

skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.getmodel does not contain any logic to prevent arbitrary code execution. The Card.getmodel function supports both joblib and skops for model loading. When loading...

Skops 代码问题漏洞

Skops is a Python library from the Skops project that helps share scikit-learn-based models and put them into production. A code issue vulnerability exists in Skops 0.12.0 and earlier versions that stems from the Card.getmodel function not preventing arbitrary code execution, which could lead to ...

Deserialization of Untrusted Data

Overview skops is an A set of tools to push scikit-learn based models to and pull from Hugging Face Hub Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the getmodel function due to insecure pickle loading. An attacker can execute arbitrary code by supplyi...

PT-2025-32333

Name of the Vulnerable Software and Affected Versions skops versions 0.12.0 and below skops versions prior to 0.13.0 Description The Card.get model function in skops allows for arbitrary code execution when loading models. This occurs because the function supports both joblib and skops for model...

PYSEC-2025-97

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secu...