Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector for remote artifact storage access; high complexity for MD5 collision; low privilege per authenticated wandb requirement; both confidentiality and integrity impacts apply given file substitution and hash exposure.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.
AnalysisAI
Artifact Integrity Validation in wandb 0.25.2.dev1 uses MD5 (a cryptographically broken hash algorithm) within ArtifactManifestEntry.download in wandb/sdk/lib/hashutil.py, enabling a sufficiently resourced attacker with write access to artifact storage or a man-in-the-middle network position to substitute a malicious artifact file that shares the same MD5 digest as a legitimate one, bypassing download integrity checks. The CVSS 4.0 base score of 2.3 reflects high attack complexity and the requirement for authenticated access (PR:L), placing real-world exploitability firmly in the theoretical-to-low range. No public exploit exists and the vulnerability has no CISA KEV listing; an upstream fix via SHA-256 supplementation is available as an unmerged GitHub PR (#12031).
Technical ContextAI
wandb (Weights & Biases) is a Python library for ML experiment tracking and artifact management, identified by CPE cpe:2.3:a:n/a:wandb:*:*:*:*:*:*:*:*. The affected code path is ArtifactManifestEntry.download in wandb/sdk/lib/hashutil.py, which verifies downloaded artifact file integrity using MD5 digests (md5_file_b64) stored in the artifact manifest. CWE-328 (Use of Weak Hash) is the root cause: MD5 is not collision-resistant and has known chosen-prefix and identical-prefix collision attacks, making it unsuitable for integrity verification in adversarial contexts. The fix in PR #12031 augments the existing MD5 manifest digest with a SHA-256 hash stored in the extra field of ArtifactManifestEntry (sha256_file_b64), and validates this stronger hash during download and artifact.verify() calls, rejecting files where the SHA-256 does not match. The ArtifactManifestV1.digest() method is also updated to incorporate the SHA-256 when present, ensuring manifest-level integrity is also strengthened.
RemediationAI
The primary fix is available as an upstream pull request at https://github.com/wandb/wandb/pull/12031, which introduces SHA-256 integrity verification (sha256_file_b64) as a supplementary check alongside the existing MD5 digest in ArtifactManifestEntry. As of the time of analysis, this PR had not yet been merged and a released patched version is not independently confirmed - users should monitor https://github.com/wandb/wandb/ release notes and upgrade to the first tagged release incorporating PR #12031 once available. As a compensating control, restrict write permissions on artifact storage backends (e.g., S3 bucket policies, GCS IAM) to only trusted CI/CD principals, which removes the precondition for file substitution attacks. Enforcing HTTPS-only connections to artifact registries removes the network interception prerequisite. Pinning artifacts to specific content-addressed digests in reproducible pipelines provides additional defense at the workflow level. These controls carry the trade-off of added operational overhead but do not require waiting for the upstream patch.
Same weakness CWE-328 – Use of Weak Hash
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today