PyOD unpickle RCE: load() executes joblib.load before envelope validation

Vulnerability Overview Title: Security: persistence.load unpickles artifacts before envelope validation #697 Description: executes before verifying whether the loaded object is a PyOD persistence envelope. Since deserialization can execute Python code during loading, crafted artifacts can execute code before the , schema validation, dependency version checks, or rejection logic are executed. Impact: This is not a default network exposure issue in PyOD. The impact occurs when an application loads model artifacts that may be controlled by an attacker or not fully trusted, such as user-uploaded models, third-party artifacts, shared model directories, CI artifacts, or external model registries. Scope Affected Component: Function: Observed Version: 3.5.2 Remediation Expected Behavior: If the envelope is intended to provide a validation boundary, metadata should be checked before deserializing the model payload, or the API should make the trust boundary explicit to all callers. Actual Behavior: deserializes the entire artifact first. Malicious artifacts can execute code with the permissions of the Python process before and related validation logic are executed. Recommendations: Validate the envelope before deserialization. Ensure that the envelope structure is not a security boundary before deserialization. If the current layout must be maintained, document as being for trusted artifacts only. Alternatively: read metadata from a small, non-pickle header before performing any deserialization. POC Code Additional Information Related Code Paths: 1. calls . 2. The returned object is passed to . 3. then checks . 4. Schema/version/strict mode checks only occur after the object has already been deserialized. Impact: - If an attacker can cause a victim application to call on an attacker-controlled artifact, this may lead to arbitrary code execution under the account running the loading process. Consequences may include credential theft, data exfiltration, model result tampering, persistence, lateral movement, or denial of service, depending on the deployment environment. - Severity is context-dependent: higher severity applies to ML platforms, automated evaluation systems, CI/CD pipelines, or services importing external model artifacts. Lower severity applies when users only use artifacts generated by their own trusted training pipelines. Notes: - Documentation already warns that can execute arbitrary Python code and that the persistence wrapper does not sandbox deserialization. This report specifically highlights the order of verification in : and envelope validation do not mitigate malicious pickle execution, as they run after deserialization. Participants: - opened this issue. - and also participated in the discussion. Links: - linked a pull request that closed this issue. - mentioned a pull request fixing a minor issue. Summary This vulnerability involves the function deserializing artifacts before validating the envelope, which can lead to arbitrary code execution. Remediation includes validating the envelope before deserialization and ensuring that the envelope structure is not a security boundary prior to deserialization.

Goal Reached Thanks to every supporter — we hit 100%!

PyOD unpickle RCE: load() executes joblib.load before envelope validation

More from this source