CVSS 4.0
8.7 highCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HCVE-2025-54412
High (8.7). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in skops 0.12.0.
skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistency in the OperatorFuncNode which can be exploited to hide the execution of untrusted operator methods. This can then be used in a code reuse attack to invoke seemingly safe functions and escalate to arbitrary code execution with minimal and misleading trusted types. This is fixed in version 0.12.0.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-11-01)
- CWE
- CWE-351
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m7f4-hrc6-fwg3 | PyPI | skops | <0.12.0 | 0.12.0 |
| PYSEC-2026-1927 | PyPI | skops | <0.12.0 | 0.12.0 |