{"data":{"id":"fdb5cfed-0332-4f2f-91e0-d7c28e55caa8","title":"CVE-2026-38950: An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files…","summary":"CVE-2026-38950 affects ESA AnomalyMatch before 1.3.1. Its components load model files from session directories using torch.load() with unrestricted deserialization, so attackers can execute arbitrary code through crafted model checkpoint files. The weakness is classified as CWE-502, Deserialization of Untrusted Data.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-38950","publishedAt":"2026-06-01T17:16:59.257Z","cveId":"CVE-2026-38950","cweIds":["CWE-502"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ESA AnomalyMatch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ESA AnomalyMatch unsafe deserialization of model checkpoint files","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00144,"epssCheckedAt":"2026-11-05T06:10:13.826Z","kevDateAdded":null,"advisoryAliases":["GHSA-84q4-pj7g-82qq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T00:09:45.657Z","patchAvailable":null,"disclosureDate":"2026-06-01T17:16:59.257Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"model","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}