CVE-2020-13092

Published 15 May 2020 · Updated 04 Aug 2024

Follow this CVE + Monitor scikit-learn + Monitor scikit-learn

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 3.5%

scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the joblib.load() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner

Affected products

n/a · n/a

References

https://github.com/0FuzzingQ/vuln/blob/master/sklearn%20unserialize.md https://scikit-learn.org/stable/modules/model_persistence.html#security-maintainability-limitations