CVE-2024-45857 — Cleanlab / cleanlab

CVE-2024-45857

Cleanlab / cleanlab PUBLISHED

Description (CNA)

Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.

Affected (CNA)

Vendor / product	Versions
Cleanlab / cleanlab	affected 2.4.0 through *

CWE

CWE-502

References

https://hiddenlayer.com/sai-security-advisory/2024-09-cleanlab/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.