Listen to this Post
How the CVE Works
The vulnerability exploits `MethodNode` in skops to bypass security checks during object deserialization. By chaining `MethodNode` instances, an attacker can traverse Python’s object hierarchy and access dangerous attributes like __builtins__. The exploit abuses dot notation to silently access restricted methods (e.g., exec) without triggering `get_untrusted_types` or `load` validations. A malicious `schema.json` forces `GridSearchCV.score` to resolve `self.scorer_[self.refit]` as exec, executing arbitrary payloads (e.g., os.system('/bin/sh')) during model loading.
DailyCVE Form
Platform: skops
Version: <1.7.0
Vulnerability: Arbitrary code execution
Severity: Critical
Date: 2023-07-26
Prediction: Patch by 2023-08-10
What Undercode Say
from skops.io import load
load("malicious.skops") Triggers exploit
{"<strong>loader</strong>": "MethodNode", "func": "<strong>builtins</strong>"}
How Exploit
1. Chain `MethodNode` to access `__builtins__`.
2. Override `GridSearchCV` attributes (`scorer_`, `refit`).
3. Trigger `defaultdict.__getitem__` to execute payload.
Protection
- Update skops to patched version.
- Restrict `MethodNode` dot notation traversal.
- Validate `schema.json` fields pre-load.
Impact
- Remote code execution (RCE) on load.
- Bypasses all skops security mechanisms.
- No user interaction required.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
