CVE-2025-70560

HIGH
2026-02-03 [email protected] GHSA-fjm6-8xp2-4fwc
8.4
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Feb 03, 2026 - 18:16 nvd
HIGH 8.4

Tags

Python Deserialization Boltz RCE

Description

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.

Analysis

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. [CVSS 8.4 HIGH]

Technical Context

Classified as CWE-502 (Deserialization of Untrusted Data). Affects the its molecule loading component of Boltz. Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.

Affected Products

Vendor: Jwohlwend. Product: Boltz. Versions: up to 2.0.0. Component: its molecule loading.

Remediation

Monitor vendor advisories for a patch.

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +42
POC: 0

Share

CVE-2025-70560 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy