What is the CVSS score of CVE-2026-38950?

CVE-2026-38950 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ESA AnomalyMatch are affected by CVE-2026-38950?

ESA AnomalyMatch before version 1.3.1 is vulnerable to arbitrary code execution through unsafe PyTorch model deserialization.

How to fix or mitigate CVE-2026-38950?

Within 24 hours: Identify and document all ESA AnomalyMatch deployments and versions in use; restrict filesystem access to session directories to the application service account only. Within 7 days: Obtain ESA AnomalyMatch version 1.3.1 or later in a test environment; validate safetensors compatibility with your model implementations; plan deployment sequence. Within 30 days: Deploy version 1.3.1 or later to all production systems; confirm all model checkpoints are migrated to safetensors format where applicable.

ESA AnomalyMatch CVE-2026-38950

EUVD-2026-33701 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-01 mitre

GHSA-84q4-pj7g-82qq

RCE Deserialization N A Checkpoint

7.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 21:23 vuln.today

Analysis Generated

Jun 01, 2026 - 21:23 vuln.today

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.8 (HIGH)

CVE Published

Jun 01, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.

AnalysisAI

Arbitrary code execution in ESA AnomalyMatch before 1.3.1 allows local attackers with low privileges to run code under the application's process by planting a malicious PyTorch checkpoint into a session directory, which is loaded via torch.load() with weights_only=False. No public exploit is identified at time of analysis, but the upstream fix (PR #9) and a third-party advisory (imlabs.info) confirm the unsafe-deserialization root cause and the migration to safetensors.

Technical ContextAI

AnomalyMatch is the European Space Agency's semi-supervised anomaly-detection toolkit built on PyTorch. The vulnerability is a classic CWE-502 (Deserialization of Untrusted Data): SessionIOHandler.load_model and load_model_checkpoint invoked torch.load(load_path, weights_only=False) - and fell back to pickle.load() - on files inside the session checkpoints directory. Both torch.load (pre-2.6 default) and pickle.load execute arbitrary Python via __reduce__ during unpickling, so any attacker-controlled .pth or .pkl file becomes a code-execution primitive the moment a session is reopened. The upstream remediation replaces torch.save/torch.load with a new checkpoint_io module that uses HuggingFace safetensors (a tensor-only format with no executable payload) plus JSON-encoded metadata.

RemediationAI

Upgrade to ESA AnomalyMatch 1.3.1 or later, which replaces torch.save/torch.load and pickle.load with safetensors via the new anomaly_match/data_io/checkpoint_io module (see PR https://github.com/esa/AnomalyMatch/pull/9). Until the upgrade is applied, treat any pre-existing .pth or .pkl checkpoint as executable code: store session directories on per-user paths with restrictive POSIX permissions (chmod 700), never open sessions or checkpoints received from other users, collaborators, or public model repositories, and verify checksums against a known-good source before loading. If you must keep the unpatched version running, a stopgap is to patch the local load paths to call torch.load(..., weights_only=True) (PyTorch ≥2.0) or to refuse any checkpoint not matching an allowlisted SHA-256 - note that weights_only=True will break loading of legacy checkpoints that embedded non-tensor Python objects, so retraining or re-saving may be required.