p PatchFirst

CVE-2024-37065

CVE-2024-37065

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded.

CVSS 7.8 · High · EPSS 0.2%

Published
Updated

Stack: python

Affected products and versions

  • skops

    Versions
    • ≥ 0.6: Affected (semver)

    No fix published

  • skops PyPI

    Versions
    • 0.6.0
    • 0.7.0
    • 0.7.post0
    • 0.8.0
    • 0.9.0
    Affected ranges
    • ECOSYSTEM: ≥ 0.6, ≤ 0.9

    No fix published

Original sources

Check your server →