Executive brief
SKOPS is a Python library for secure model documentation and sharing used in collaborative machine learning environments. The Card class silently falls back to the insecure joblib library when loading non-.zip model files, bypassing SKOPS' built-in security checks and allowing attackers to execute arbitrary code simply by sharing a malicious model file. An attacker only needs to trick a user into instantiating a Card object with a crafted file—no explicit action or user interaction is required beyond that.
Technical details
This is a deserialization vulnerability (CWE-502) in the SKOPS Card class's get_model method. When a file is not recognized as a ZIP archive, the code silently invokes joblib.load() instead of SKOPS' secure load() function. Unlike SKOPS, joblib allows unrestricted pickle deserialization, enabling arbitrary code execution. The vulnerability is triggered automatically during Card instantiation (not requiring explicit get_model calls), with no authentication or user interaction needed. An attacker can distribute a malicious file with a .skops extension that is actually a pickle-serialized object. The vulnerability affects all versions before 0.13.0 and is fixed in version 0.13.0 and later.
Affected products
- SKOPS SKOPS <0.13.0
Timeline
- 2025-08-07: disclosed
- 2025-08-07: patched: Fixed in version 0.13.0