EUVD-2026-77169
GHSA-96qh-x5p5-9v7x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable deserialization requiring S3 write access or key control raises AC:H; low-privilege auth required; full host compromise likely if pickle is used.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read_model of the file fedml/core/distributed/communication/s3/remote_storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3_key_str causes deserialization. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unsafe deserialization in FedML up to version 0.9.6 allows low-privileged remote attackers to potentially execute arbitrary code by manipulating the s3_key_str argument passed to S3Storage.read_model in the MQTT+S3 communication backend. The function deserializes model data retrieved from S3 without adequate input validation, meaning an attacker who can influence the S3 key or the object stored at that key can supply a crafted malicious payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privilege authenticated access to the FedML MQTT+S3 communication backend - specifically the ability to supply or influence the `s3_key_str` argument passed to `S3Storage.read_model`, OR the ability to write a malicious serialized object to an S3 bucket path that the server will fetch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) rates this at 5.3 Medium with conservative impact metrics, yet the real-world risk of an unsafe deserialization vulnerability in a Python ML framework is likely higher if arbitrary pickle payloads can be injected - deserialization of untrusted Python objects typically yields full RCE on the host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the project maintainers had not responded to the GitHub issue #2267 disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today