Junglewise Threat Intelligence

CVE-2025-54412: PYSEC-2026-1927 - Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution

CVE-2025-54412 · Severity: medium · CVSS 4 · Published 2026-07-07

Technologies: skops (PyPI). Vendors: PyPI.

Executive brief

Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution

Affected products

PyPI skops

Related threats

PYSEC-2026-1925 - SKOPS Card.get_model happily allows arbitrary code execution
PYSEC-2026-1926 - Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time
PYSEC-2026-1928 - Skops unsafe deserialization