EUVD-2026-54524
GHSA-p65j-fxc2-99ww
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege write access to artifact store required; active user must materialize the artifact (UI:R); full RCE impact but no scope change beyond the vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact through the unsanitized cloudpickle.load() call in cloudpickle_materializer.py.
AnalysisAI
Remote code execution in ZenML 0.94.6 allows any attacker with write access to a shared artifact store to plant a malicious cloudpickle payload that executes arbitrary system commands when a legitimate user or pipeline materializes the tampered artifact. The root cause is unsanitized deserialization via cloudpickle.load() in CloudpickleMaterializer without any integrity verification of the stored artifact.pkl file before loading. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack is conceptually straightforward for any attacker with artifact store write access in a multi-user ZenML deployment.
Technical ContextAI
ZenML is a Python MLOps framework for orchestrating ML pipelines. Its CloudpickleMaterializer (cloudpickle_materializer.py) serializes and deserializes arbitrary Python objects using the cloudpickle library, which extends Python's native pickle protocol. CWE-502 (Deserialization of Untrusted Data) is the root cause: cloudpickle.load() reconstructs Python objects by executing __reduce__ methods embedded in the pickle stream, enabling arbitrary code execution if the serialized data is attacker-controlled. The affected CPE cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:* with a wildcard version suggests the missing integrity check is a longstanding design gap, not limited to a single release. The fix (PR #5103, commit bbf8496d) introduces SHA-256 content hashing at save time via a CallbackWriter proxy, stores the hash in artifact version metadata, and validates it before calling cloudpickle.loads() at load time - raising a RuntimeError on mismatch, preventing tampered payloads from executing.
RemediationAI
The upstream fix is available via GitHub commit bbf8496d049a7e23800bc31b87b10b4fefbebe18 (https://github.com/zenml-io/zenml/commit/bbf8496d049a7e23800bc31b87b10b4fefbebe18) and PR #5103 (https://github.com/zenml-io/zenml/pull/5103); however, a specific patched tagged release version is not independently confirmed from the available data - users should monitor the ZenML release channel at https://github.com/zenml-io/zenml and upgrade to the first release incorporating this commit. As an immediate compensating control, restrict write access to shared artifact stores to the minimum set of trusted principals, removing write permissions for any non-essential users or pipeline service accounts - this directly eliminates the attacker's ability to plant the malicious payload. Additionally, audit artifact store access logs for unexpected write operations to artifact.pkl files. Avoid using CloudpickleMaterializer for artifacts materialized across trust boundaries until the patched version is deployed; where possible, substitute a type-safe materializer that does not rely on pickle deserialization. VulnCheck advisory is available at https://www.vulncheck.com/advisories/zenml-remote-code-execution-via-cloudpicklematerializer.
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpo
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because t
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1
A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. Rated medium sever
A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failu
zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password chan
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within t
zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cl
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Rated low severity (CVSS 3.3), this vulne
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creati
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today