{"data":{"id":"a9292361-2294-45a9-8135-058ba0582b78","title":"CVE-2020-13092: scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to…","summary":"scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file passed to joblib.load(), if __reduce__ makes an os.system call. Third parties dispute this issue, noting that joblib.load() is documented as unsafe and that using it securely is the user's responsibility. The weakness is classified as CWE-502, Deserialization of Untrusted Data.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-13092","publishedAt":"2020-05-15T23:15:12.277Z","cveId":"CVE-2020-13092","cweIds":["CWE-502"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["scikit-learn@<= 0.23.0"],"affectedPackageNames":["scikit-learn"],"affectedPackageRefs":["pypi:scikit-learn"],"affectedVendors":[],"affectedVendorsRaw":["scikit-learn"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"scikit-learn unsafe deserialization via joblib.load of untrusted file","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.03406,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-jjw5-xxj6-pcv5"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T04:01:07.607Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}