Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

skops

4 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 4 high
Registry
PyPI

Advisories 4

  • skops: Card.get_model does not block arbitrary code execution

    Affected: fixed in 0.13.0.

  • skops' MethodNode can access unexpected object fields through dot notation, leading to arbitrary code execution at load time

    Affected: fixed in 0.12.0.

  • skops' Inconsistent Trusted Type Validation Enables Hidden `operator` Methods Execution

    Affected: fixed in 0.12.0.

  • Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to…

    Affected: from 0.6, through 0.9.