p PatchFirst

CVE-2024-45857

CVE-2024-45857

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.

CVSS 7.8 · High · EPSS 0.2%

Published
Updated

Stack: python

Affected products and versions

  • cleanlab

    Versions
    • ≥ 2.4.0: Affected (semver)

    No fix published

  • cleanlab PyPI

    Versions
    • 2.4.0
    • 2.5.0
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.6.4
    • 2.6.5
    • 2.6.6
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0, ≤ 2.6.6

    No fix published

Original sources

Check your server →