Home » Database

AVID-2026-R1536

Description

Vulnerability CVE-2024-45857

Details

Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.

Reason for inclusion in AVID: CVE-2024-45857 describes a deserialization vulnerability in the Cleanlab library (versions >= 2.4.0) that allows arbitrary code execution when loading a crafted datalab.pkl. Cleanlab is an ML data preprocessing/cleaning library commonly used in AI pipelines, making this a software supply-chain vulnerability in AI systems. It affects software components used to build/run AI systems. The vulnerability is clearly security-related (RCE). Evidence provided includes CVE entry and description.

References

Affected or Relevant Artifacts

  • Developer: Cleanlab
  • Deployer: Cleanlab
  • Artifact Details:
TypeName
Systemcleanlab

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score7.8
Base Severity🔴 High
Attack VectorLOCAL
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-502CWE-502 Deserialization of Untrusted Data

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-09-12
  • Version: 0.3.3
  • AVID Entry