{"data":{"id":"78bbf91b-e5c1-47ba-b5c7-169ca2d984af","title":"CVE-2026-31238: The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component…","summary":"CVE-2026-31238 affects the Ludwig framework through version 0.10.4, in its model serving component (CWE-502). When a model server starts with the ludwig serve command, the framework loads model weight files with torch.load() without setting weights_only=True, so arbitrary Python objects can be deserialized via the pickle module. An attacker who supplies a maliciously crafted PyTorch model file can achieve arbitrary code execution on the host running the Ludwig model server.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31238","publishedAt":"2026-05-12T18:16:52.210Z","cveId":"CVE-2026-31238","cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["ludwig@<= 0.10.4"],"affectedPackageNames":["ludwig"],"affectedPackageRefs":["pypi:ludwig"],"affectedVendors":[],"affectedVendorsRaw":["Ludwig"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Ludwig insecure deserialization in model serving via torch.load","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00497,"epssCheckedAt":"2026-11-07T06:14:03.427Z","kevDateAdded":null,"advisoryAliases":["GHSA-xp5q-5q7g-q26r"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:28.502Z","patchAvailable":null,"disclosureDate":"2026-05-12T18:16:52.210Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}