{"data":{"id":"9fbbdd08-487d-415b-936c-4844fa31ed75","title":"CVE-2025-54886: skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and…","summary":"skops, a Python library for sharing scikit-learn models, versions 0.12.0 and below, has a flaw in Card.get_model that permits arbitrary code execution. When a non-.zip model file is supplied, the function silently falls back to joblib, which runs code during loading and bypasses skops' trusted type validation.","solution":"Fixed in 0.13.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54886","publishedAt":"2025-08-08T05:15:25.120Z","cveId":"CVE-2025-54886","cweIds":["CWE-502"],"cvssScore":"8.4","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["skops@< 0.13.0 (fixed: 0.13.0)"],"affectedPackageNames":["skops"],"affectedPackageRefs":["pypi:skops"],"affectedVendors":[],"affectedVendorsRaw":["skops","scikit-learn","joblib"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"skops Card.get_model arbitrary code execution through joblib fallback","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00235,"epssCheckedAt":"2026-11-04T12:08:34.749Z","kevDateAdded":null,"advisoryAliases":["GHSA-378x-6p4f-8jgm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:58.569Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-08-06T09:48:13.356Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:43:57.495Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"skops","fixedVersion":"0.13.0","matchedVersion":"0.13.0","fixReleasedAt":"2025-08-06T09:48:13.356Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:57.343Z"}]}}