Read the docs
TI-2025-34620 Aliases CVE-2025-54886GHSA-378x-6p4f-8jgm

skops: Card.get_model does not block arbitrary code execution

Priority HIGH 72CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.get_model does not contain any logic to prevent arbitrary code execution. The Card.get_model function supports both joblib and skops for model loading. When loading .skops models, it uses skops' secure loading with trusted type validation, raising errors for untrusted types unless explicitly allowed. However, when non-.zip file formats are provided, the function silently falls back to joblib without warning. Unlike skops, joblib allows arbitrary code execution during loading, bypassing security measures and potentially enabling malicious code execution. This issue is fixed in version 0.13.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed skops (skops-dev): 0.13.0skops (PyPI): 0.13.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
skops-devskopsbefore 0.13.00.13.0Patch availableCNA
—skops (PyPI)before 0.13.00.13.0Patch availableGHSA-378x-6p4f-8jgm
  • skops Vendorskops-dev Affected before 0.13.0 Fixed in 0.13.0 Patch available CNA
  • skops (PyPI) Vendor— Affected before 0.13.0 Fixed in 0.13.0 Patch available GHSA-378x-6p4f-8jgm

Remediation

  • Fix · CNA skops (skops-dev) Fixed in 0.13.0
  • Fix · GHSA-378x-6p4f-8jgm skops (PyPI) Fixed in 0.13.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54886
  2. 2026-10-03 Alias added: GHSA-378x-6p4f-8jgm

References

Advisory 1

Other 4

  • TI-2025-34219 skops' MethodNode can access unexpected object fields through dot notation, leading to… CVSS 4.0HIGH 8.7
  • TI-2025-34218 skops' Inconsistent Trusted Type Validation Enables Hidden `operator` Methods Execution CVSS 4.0HIGH 8.7
  • TI-2024-24603 Deserialization of untrusted data in skops-dev Skops CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences