EUVD-2026-54524
GHSA-p65j-fxc2-99ww
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege write access to artifact store required; active user must materialize the artifact (UI:R); full RCE impact but no scope change beyond the vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact through the unsanitized cloudpickle.load() call in cloudpickle_materializer.py.
AnalysisAI
Remote code execution in ZenML 0.94.6 allows any attacker with write access to a shared artifact store to plant a malicious cloudpickle payload that executes arbitrary system commands when a legitimate user or pipeline materializes the tampered artifact. The root cause is unsanitized deserialization via cloudpickle.load() in CloudpickleMaterializer without any integrity verification of the stored artifact.pkl file before loading. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific, concurrent conditions: first, the attacker must hold write access to the ZenML artifact store backend (e.g., S3 bucket, GCS bucket, Azure Blob, or local filesystem) where ZenML artifacts are persisted - this is the PR:L condition in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) scores 8.5, reflecting a network-reachable attack requiring low privilege and active user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a service account or team member account with write access to a shared ZenML artifact store replaces a frequently-used artifact.pkl file with a crafted cloudpickle payload whose __reduce__ method spawns a reverse shell or exfiltrates credentials. The next time any legitimate user or scheduled pipeline step materializes that artifact - a normal ML workflow operation - the malicious code executes in the context of the pipeline runner, potentially with access to model weights, training data, and cloud credentials mounted in that environment. … |
| Remediation | The upstream fix is available via GitHub commit bbf8496d049a7e23800bc31b87b10b4fefbebe18 (https://github.com/zenml-io/zenml/commit/bbf8496d049a7e23800bc31b87b10b4fefbebe18) and PR #5103 (https://github.com/zenml-io/zenml/pull/5103); however, a specific patched tagged release version is not independently confirmed from the available data - users should monitor the ZenML release channel at https://github.com/zenml-io/zenml and upgrade to the first release incorporating this commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all ZenML 0.94.6 deployments and document artifact store write access patterns; immediately restrict write permissions to artifact stores to minimize exposure until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpo
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because t
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1
A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. Rated medium sever
A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failu
zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password chan
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within t
zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cl
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Rated low severity (CVSS 3.3), this vulne
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creati
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today