ailab-lite (>=0.1.1, <=0.1.14), aioradio (0.20.24) +40 more potentially affected by CVE-2025-54886 via skops (>=0.1.0.dev0, <=0.11.0)

skops PYPI version =0.1.0.dev0, =0.1.1, =0.2.2.dev0, =23.10.1, =0.1.1, =1.0.4, =23.8.0, =0.0.1, =1.0.0, =0.0.5, =0.0.1, =0.2.0, =0.1.4, =0.1.9 and more Source cves: CVE-2025-54886 Source advisory: OSV:PYSEC-2026-1925...

PYSEC-2026-1925 SKOPS Card.get_model happily allows arbitrary code execution

Summary The Card class of skops, used for model documentation and sharing, allows arbitrary code execution. When a file other than .zip is provided to the Card class during instantiation, the internally invoked Card.getmodel method silently falls back to joblib without warning. Unlike the .skops...

SKOPS Card.get_model happily allows arbitrary code execution

SummaryThe Card class of skops, used for model documentation and sharing, allows arbitrary code execution. When a file other than .zip is provided to the Card class during instantiation, the internally invoked Card.getmodel method silently falls back to joblib without warning. Unlike the .skops...

ailab-lite (>=0.1.1, <=0.1.14), aioradio (0.20.24) +40 more potentially affected by CVE-2025-54413 via skops (>=0.1.0.dev0, <=0.11.0)

skops PYPI version =0.1.0.dev0, =0.1.1, =0.2.2.dev0, =23.10.1, =0.1.1, =1.0.4, =23.8.0, =0.0.1, =1.0.0, =0.0.5, =0.0.1, =0.2.0, =0.1.4, =0.1.9 and more Source cves: CVE-2025-54413 Source advisory: OSV:PYSEC-2026-1926...

ailab-lite (>=0.1.1, <=0.1.14), aioradio (0.20.24) +40 more potentially affected by CVE-2025-54412 via skops (>=0.1.0.dev0, <=0.11.0)

skops PYPI version =0.1.0.dev0, =0.1.1, =0.2.2.dev0, =23.10.1, =0.1.1, =1.0.4, =23.8.0, =0.0.1, =1.0.0, =0.0.5, =0.0.1, =0.2.0, =0.1.4, =0.1.9 and more Source cves: CVE-2025-54412 Source advisory: OSV:PYSEC-2026-1927...

Skops unsafe deserialization

Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded...

bystro (>=1.0.4, <=2.1.3), coco-rasa (>=0.0.1, <=0.0.3) +11 more potentially affected by CVE-2024-37065 via skops (>=0.6.0, <=0.9.0)

skops PYPI version =0.6.0, =1.0.4, =0.0.1, =0.0.5, =0.0.1, =2.0.0, =1.0.4, =0.0.3, =0.1.0, =0.0.2, =0.1.0, =1.3.8, =1.9.0 Source cves: CVE-2024-37065 Source advisory: OSV:PYSEC-2026-1928...

PYSEC-2026-1928 Skops unsafe deserialization

Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded...

EUVD-2025-22762

Malicious code in bioql PyPI...

EUVD-2025-23967

Malicious code in bioql PyPI...

EUVD-2025-22763

Malicious code in bioql PyPI...

EUVD-2024-2133

Malicious code in bioql PyPI...

CVE-2025-54886

skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.getmodel does not contain any logic to prevent arbitrary code execution. The Card.getmodel function supports both joblib and skops for model loading. When loading...

CVE-2025-54886

The CVE-2025-54886 issue affects the Python library skops, specifically the Card.get_model path. In versions 0.12.0 and earlier, when loading models, Card.get_model does not adequately prevent arbitrary code execution: if a non-.zip file is provided, it silently falls back from the secure skops l...

CVE-2025-54886

skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.getmodel does not contain any logic to prevent arbitrary code execution. The Card.getmodel function supports both joblib and skops for model loading. When loading...

aioradio (0.20.24), aisquared (>=0.2.2.dev0, <=0.2.2.dev9) +33 more potentially affected by CVE-2025-54886 via skops (>=0.5.0, <=0.11.0)

skops PYPI version =0.5.0, =0.2.2.dev0, =23.10.1, =0.1.1, =1.0.4, =23.8.0, =0.0.1, =1.0.0, =0.0.5, =0.0.1, =1.2.15, =2.2.0, =2.3.0 and more Source cves: CVE-2025-54886 Source advisory: MEND:CVE-2025-54886...

CVE-2025-54886 skops: Card.get_model does not block arbitrary code execution

skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.getmodel does not contain any logic to prevent arbitrary code execution. The Card.getmodel function supports both joblib and skops for model loading. When loading...

CVE-2025-54886 skops: Card.get_model does not block arbitrary code execution

skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.getmodel does not contain any logic to prevent arbitrary code execution. The Card.getmodel function supports both joblib and skops for model loading. When loading...

Skops code issues and vulnerabilities

Skops is a Python library from the Skops project that helps share scikit-learn-based models and put them into production. A code issue vulnerability exists in Skops 0.12.0 and earlier versions that stems from the Card.getmodel function not preventing arbitrary code execution, which could lead to ...

CVE-2025-54886: Deserialization of Untrusted Data

skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.getmodel does not contain any logic to prevent arbitrary code execution. The Card.getmodel function supports both joblib and skops for model loading. When loading...