Recommenders
Monthly
Deserialization of untrusted data in Microsoft Recommenders (recommenders-team/recommenders) up to and including version 1.2.1 lets an attacker who supplies a crafted MIND dictionary or vocabulary artifact execute arbitrary code when the newsrec iterator at recommenders/models/newsrec/io/mind_iterator.py calls pickle.load. The issue is gated on user interaction rather than a listening service: a developer or automated training pipeline must deliberately point the MIND iterator at the poisoned serialized dict, which is why the vendor's CVSS 4.0 rating is only 5.1/PR:L/UI:P while the independent assessment rates it CVSS:3.1 AV:N/AC:L/PR:N/UI:R with C:H/I:H/A:H. Publicly available exploit code exists (the public GitHub issue report recommenders-team/recommenders#2368), but there is no evidence of confirmed active exploitation and no KEV listing; the project was informed early via that issue but has not responded, and no vendor-released patch has been identified at time of analysis.
Deserialization of untrusted data in Microsoft Recommenders (recommenders-team/recommenders) up to and including version 1.2.1 lets an attacker who supplies a crafted MIND dictionary or vocabulary artifact execute arbitrary code when the newsrec iterator at recommenders/models/newsrec/io/mind_iterator.py calls pickle.load. The issue is gated on user interaction rather than a listening service: a developer or automated training pipeline must deliberately point the MIND iterator at the poisoned serialized dict, which is why the vendor's CVSS 4.0 rating is only 5.1/PR:L/UI:P while the independent assessment rates it CVSS:3.1 AV:N/AC:L/PR:N/UI:R with C:H/I:H/A:H. Publicly available exploit code exists (the public GitHub issue report recommenders-team/recommenders#2368), but there is no evidence of confirmed active exploitation and no KEV listing; the project was informed early via that issue but has not responded, and no vendor-released patch has been identified at time of analysis.