CVE-2024-45857

Advisory

Cleanlab project affected versions contain a security vulnerability in the deserialization process. When loading a data directory, a maliciously crafted datalab.pkl file can execute arbitrary code on the user's system. This vulnerability stems from the use of the pickle module for deserialization without proper safeguards. Attackers can exploit this flaw to compromise systems, potentially leading to data theft, system manipulation, or further malware deployment. Users should exercise extreme caution when loading data from untrusted sources, and consider updating to a patched version if available.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-8cm9-rrgc-4pcj
• https://github.com/cleanlab/cleanlab/blob/e604611b9bbdc89f91103c8112289faf56854619/cleanlab/datalab/internal/serialize.py#L102-L138
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45857