CVE-2025-54886: skops Arbitrary Code Execution Vulnerability
Summary
CVE-2025-54886: SKOPS Card.get_model happily allows arbitrary code execution. Affects skops versions < 0.13.0. Fixed in 0.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The skops package is designed for model documentation and sharing in Python, primarily used in machine learning applications. It allows users to create and manage model cards that provide metadata about machine learning models. However, a significant security flaw exists in the Card class, which can lead to arbitrary code execution when improperly formatted model files are loaded.
Vulnerability Detail
The vulnerability arises from the Card class's handling of model files. When a file other than a .zip is provided, the Card.get_model method defaults to using the joblib library for loading the model without any warning. This behavior bypasses the security mechanisms inherent in skops, allowing malicious code execution through untrusted files. The issue is exacerbated by the fact that the user does not need to explicitly call get_model; it is invoked during the instantiation of the Card object. This silent fallback to joblib poses a significant risk, especially in collaborative environments where users may unknowingly load compromised files.
How To Fix
Latest published version: 0.16.0 as of 23 Oct 2026
pip install --upgrade "skops==0.16.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.0
This is the first release that contains the fix.
pip install --upgrade "skops==0.13.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should ensure that only .zip files are provided to the Card class during instantiation. For example:
from skops.card import Card
# Ensure the model file is a .zip file
card = Card('model.zip')
Conclusion
The skops package contains a critical vulnerability (CVE-2025-54886) that allows arbitrary code execution through improper file handling. Users are strongly advised to update to the patched version 0.13.0 or later and to implement workarounds until the update can be applied.
See every vulnerability recorded for skops →
FAQ
CVE-2025-54886 is a vulnerability in the skops package that allows arbitrary code execution through improper handling of model files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If an immediate update is not possible, ensure that only .zip files are used with the Card class to mitigate the risk of arbitrary code execution.
The CVSS score for this vulnerability is 8.4, indicating a high severity level.
More information about skops can be found on its official documentation and repository on GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for skops.
