W&B Python SDK Artifact Integrity Verification Bypass (CVE-Expected)

Vulnerability Overview Vulnerability ID: #12030 Title: [Bug]: Artifact integrity report follows security policy Description: A potential security issue was discovered in the artifact processing path of the W&B Python SDK. According to SECURITY.md, W&B requires reporters to send vulnerabilities to security@wandb.com, and technical details, proof-of-concept (PoC) materials, or reproduction steps are not included in this public issue. Full technical reports should be coordinated through documented secure channels. Impact Scope Affected Areas: - Artifact handling and integrity/download verification in the W&B Python SDK. Observed Versions/Context: - Repository Commit: 28cc9f5a962b7e7e5e581d9a48c64223a9e1a - Package Version: wandb.__version__ = "0.15.3.dev4" - Python Version: Non-specific Python version - Operating System: Non-specific operating system - W&B Server Version: Unknown; the affected behavior resides in the artifact path of the Python SDK. Expected Behavior: - Artifact integrity verification should use collision-resistant content digests and reject replaced content that does not match the expected artifact bytes. Actual Behavior: - The affected SDK path may accept artifact content fetched with insufficient integrity checks. Details have been intentionally omitted from this public issue pending coordinated disclosure. Remediation Related Fix: - PR #12031 (fix[artifacts]: verify files with sha256 integrity digest #12031) proposes SHA-256-based artifact file integrity handling while maintaining compatibility with existing artifact entries. Additional Information Participants: - 3em0: Reported the issue and linked the fix pull request. - wilryagain: Thanked the reporter. - rehan243: Discussed security defense layers for production AI systems. - bgiglzd: Mentioned another related issue, #12198. Code Snippet No PoC code or exploitation code.

Goal Reached Thanks to every supporter — we hit 100%!

W&B Python SDK Artifact Integrity Verification Bypass (CVE-Expected)

More from this source