What is the CVSS score of CVE-2026-31237?

CVE-2026-31237 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ludwig framework are affected by CVE-2026-31237?

Ludwig framework versions 0.10.4 and earlier contain a critical arbitrary code execution vulnerability in the predict() method that allows unauthenticated remote attackers to achieve full system…

How to fix or mitigate CVE-2026-31237?

Within 24 hours: Audit all Ludwig framework deployments and document versions in use; immediately implement strict input validation to reject .pkl file uploads if Ludwig versions ≤0.10.4 are in production. Within 7 days: Isolate any Ludwig predict() endpoints from untrusted input sources; implement network segmentation to limit lateral movement from compromised systems; configure file type whitelisting to block .pkl files at the application layer. Within 30 days: Evaluate migration to Ludwig 0.10.5 or later if available; if unavailable, develop and test alternative model inference pipelines using safer serialization formats (e.g., ONNX, SavedModel) and plan full framework replacement.

Ludwig framework CVE-2026-31237

EUVD-2026-29560 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-12 mitre

GHSA-wcr3-gm9f-f87q

Python RCE Deserialization N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 20:23 vuln.today

CVSS changed

May 14, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

CRITICAL 9.8

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method. When a user provides a dataset file path to the predict() method, the framework automatically determines the file format. If the file is a pickle (.pkl) file, it is loaded using pandas.read_pickle() without any validation or security restrictions. This allows the deserialization of arbitrary Python objects via the unsafe pickle module. A remote attacker can exploit this by providing a maliciously crafted pickle file, leading to arbitrary code execution on the system running the Ludwig prediction.

AnalysisAI

Arbitrary code execution in Ludwig framework ≤0.10.4 occurs when attackers supply malicious pickle files to the predict() method, which deserializes untrusted data without validation using pandas.read_pickle(). Remote unauthenticated attackers can achieve full system compromise by exploiting the automatic file format detection mechanism that processes .pkl files through Python's unsafe pickle module. EPSS score of 0.06% (19th percentile) suggests low current exploitation likelihood despite the critical CVSS 9.8 rating, though no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Ludwig is an open-source declarative machine learning framework built on TensorFlow. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data) in the predict() method's file handling logic. When users invoke predict() with a dataset file path, Ludwig automatically detects file format and routes .pkl files to pandas.read_pickle(), which internally uses Python's pickle module. Pickle is a Python-native serialization protocol that can reconstruct arbitrary Python objects, including those with __reduce__ methods that execute code during deserialization. Unlike JSON or CSV parsers, pickle was explicitly designed for trusted data only and provides no sandboxing. The framework's automatic format detection creates an unsafe code path where external input directly controls which deserialization mechanism is invoked, violating the principle that untrusted data should never flow to pickle.load() or its wrappers.

RemediationAI

Upgrade to Ludwig framework version 0.10.5 or later once a patched release becomes available, monitoring the official GitHub repository at https://github.com/ludwig-ai/ludwig for security updates. As of this analysis, no vendor-released patch version has been independently confirmed in the provided data. Immediate compensating controls include: (1) Implement strict allowlist validation of file extensions before passing paths to predict(), rejecting .pkl files entirely and accepting only safe formats like .csv, .json, or .parquet; (2) Use file content validation rather than relying on extensions, checking magic bytes to prevent .pkl.csv-style bypass attempts; (3) If pickle files are business-critical, deserialize them in isolated sandboxed processes with minimal privileges using containers or separate service accounts, though note that sophisticated pickle exploits can escape some sandboxes; (4) Never expose predict() directly to internet-facing APIs or user file uploads without a secure file processing layer that converts uploads to safe formats server-side. Trade-offs: Blocking pickle files eliminates a legitimate serialization format used in some ML workflows, requiring data pipeline changes. Sandboxing adds operational complexity and latency. Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-31237 and vendor notification page https://www.notion.so/CVE-2026-31237-35d1e139318881fb95a2ee7c5d0e17d8.