CVE-2025-70560

Katalog CVE

CVSS 8.4 · High EPSS 0,17%

Kerentanan Deserialization of Untrusted Data pada jwohlwend boltz. Skor CVSS 3.1 8.4 (High) menurut CISA ADP.

Deskripsi (NVD)

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.

Rincian

Terbit di NVD

3 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.4 (High), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/advisories/GHSA-fjm6-8xp2-4fwc
• https://github.com/jwohlwend/boltz/blob/cb04aeccdd480fd4db707f0bbafde538397fa2ac/src/boltz/data/mol.py#L80 product
• https://github.com/jwohlwend/boltz/issues/600 issue tracking