Executive brief
The Adversarial Robustness Toolbox (ART) is a software library used by developers and data scientists to test the security of machine learning models. A critical vulnerability in its Kubeflow component allows an attacker to execute malicious code on a system by providing a specially crafted model file. This could lead to a full system takeover, data theft, or disruption of machine learning pipelines.
Technical details
An insecure deserialization vulnerability (CWE-502) exists in the Kubeflow component of the Adversarial Robustness Toolbox (ART) through version 1.20.1. The vulnerability is rooted in the use of 'torch.load()' without the 'weights_only=True' parameter when loading model weights (e.g., model.pt) during robustness evaluations. This allows the Pickle module to deserialize arbitrary Python objects. An attacker can achieve remote code execution by uploading a malicious model file to a storage location referenced by the pipeline or by manipulating the 'model_id' parameter to point to a malicious file. No authentication or user interaction is required if the attacker can influence the model source.
Affected products
- Trusted-AI Adversarial Robustness Toolbox (ART) up to and including 1.20.1
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory