Executive brief
Skops unsafe deserialization
Affected products
- PyPI skops
Junglewise Threat Intelligence
CVE-2024-37065: PYSEC-2026-1928 - Skops unsafe deserialization
CVE-2024-37065 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: skops (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1925 - SKOPS Card.get_model happily allows arbitrary code execution
- PYSEC-2026-1926 - Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time
- PYSEC-2026-1927 - Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution