MediumVulnerability
CVE-2022-36022: Deeplearning4J examples use unclaimed S3 buckets in tests
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2022-36022
- Published
- Record updated
- Affected
- org.deeplearning4j:platform-tests <= 1.0.0-M2.1
- org.deeplearning4j:dl4j-examples <= 1.0.0-M2.1
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
Packages org.deeplearning4j:dl4j-examples and org.deeplearning4j:platform-tests through version 1.0.0-M2.1 reference unclaimed S3 buckets in some older NLP examples. Anyone who runs those examples could pull data from a bucket that an attacker may have claimed.
Mitigation
The problem has been patched. Users should upgrade to snapshots, as Deeplearning4J plan to publish a release with the fix at a later date. As a workaround, download a word2vec google news vector from a new source using git lfs from here.
Related items
- MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- HighCVE-2026-118627: MLflow SHAP load_explainer untrusted deserialization enables code executionSimilar attack · NVD/CVE Database
- HighCVE-2026-118623: MLflow PickleEvaluationArtifact remote code execution via untrusted pickleSimilar attack · NVD/CVE Database
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSimilar attack · NVD/CVE Database