What is the CVSS score of CVE-2025-11157?

CVE-2025-11157 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-11157?

Organizations using feast-dev/feast face notable risk from CVE-2025-11157, a insecure deserialization vulnerability rated CVSS 7.8.. A patch is available.

How to fix or mitigate CVE-2025-11157?

Within 7 days: Identify all affected systems running feast-dev/feast and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Python CVE-2025-11157

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-01-01 security@huntr.dev

GHSA-34wm-4hw7-qfjv

Python Kubernetes RCE Deserialization

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 01, 2026 - 07:16 nvd

HIGH 7.8

DescriptionCVE.org

A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py. The vulnerability arises from the use of yaml.load(..., Loader=yaml.Loader) to deserialize /var/feast/feature_store.yaml and /var/feast/materialization_config.yaml. This method allows for the instantiation of arbitrary Python objects, enabling an attacker with the ability to modify these YAML files to execute OS commands on the worker pod. This vulnerability can be exploited before the configuration is validated, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage.

AnalysisAI

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py. The vulnerability arises from the use of yaml.load(..., Loader=yaml.Loader) to deserialize /var/feast/feature_store.yaml and /var/feast/materialization_config.yaml. This method allows for the instantiation of arbitrary Python objects, enabling an attacker with the ability t