CVE-2026-31229

{
  "id": "CVE-2026-31229",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T18:16:51.160",
  "lastModified": "2026-10-19T22:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component's model loading functionality. When loading model weights from a file (e.g., model.pt) during robustness evaluation, the code uses torch.load() without the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the Pickle module. An attacker can exploit this by uploading a maliciously crafted model file to an object storage location referenced by the pipeline, or by controlling the model_id parameter to point to such a file. When the pipeline loads the model, the malicious payload is executed, leading to remote code execution."
    },
    {
      "lang": "es",
      "value": "La Adversarial Robustness Toolbox (ART) hasta la versión 1.20.1 contiene una vulnerabilidad de deserialización insegura (CWE-502) en la funcionalidad de carga de modelos de su componente Kubeflow. Al cargar los pesos del modelo desde un archivo (por ejemplo, model.pt) durante la evaluación de robustez, el código utiliza torch.load() sin el parámetro de restricción de seguridad weights_only=True. Esto permite la deserialización de objetos Python arbitrarios a través del módulo Pickle. Un atacante puede explotar esto subiendo un archivo de modelo maliciosamente diseñado a una ubicación de almacenamiento de objetos referenciada por la pipeline, o controlando el parámetro model_id para que apunte a dicho archivo. Cuando la pipeline carga el modelo, la carga útil maliciosa se ejecuta, lo que lleva a la ejecución remota de código."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T14:13:37.684089Z",
          "id": "CVE-2026-31229",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Trusted-AI/adversarial-robustness-toolbox",
      "source": "[email protected]"
    },
    {
      "url": "https://www.notion.so/CVE-2026-31229-35d1e13931888172863dcc20beeb6b70",
      "source": "[email protected]"
    }
  ]
}