Description

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact through the unsanitized cloudpickle.load() call in cloudpickle_materializer.py.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-07T17:17:07.573Z",
  "pubdate": "2026-08-07T17:17:07.573Z",
  "executiveSummary": "ZenML version 0.94.6 contains a remote code execution vulnerability residing in the CloudpickleMaterializer component. The flaw allows threat actors with write access to a shared artifact store to achieve arbitrary code execution by substituting a legitimate stored artifact with a maliciously crafted pickle file.\nThe vulnerability type is insecure deserialization leading to remote code execution. The impact is severe, enabling attackers to execute arbitrary system commands within the operational environment of any user or pipeline that attempts to materialize the compromised artifact. Affected systems are those running ZenML version 0.94.6 utilizing the vulnerable materialization mechanism.\nThe risk implications include full compromise of the execution environment hosting the pipeline or consuming the artifact. Attacker capabilities require write access to the shared artifact store, which serves as the primary exploitation requirement for substituting the target pickle payload.",
  "technicalDetails": "The root cause of the vulnerability stems from the use of unsanitized deserialization via the cloudpickle.load() function located within the cloudpickle_materializer.py file. The CloudpickleMaterializer component lacks input validation and cryptographic integrity checks when retrieving and processing serialized Python objects from the underlying storage backend.\nThe vulnerable component is specifically the CloudpickleMaterializer class and its associated methods in cloudpickle_materializer.py within ZenML version 0.94.6. The affected systems process serialized data without verifying its source or structure, leaving them vulnerable to object injection attacks.\nThe exploitation method relies on manipulating the shared artifact storage layer. An attacker who possesses write access to the shared artifact store targets a specific artifact by locating its stored artifact.pkl file. The attacker then replaces this legitimate file with a crafted cloudpickle payload.\nThe attack flow proceeds as follows: First, the attacker gains or leverages write access to the shared artifact store. Second, the attacker overwrites or replaces the targeted artifact.pkl file with a malicious payload containing a specially crafted __reduce__ magic method. Third, an unsuspecting user or an automated pipeline initiates a retrieval operation, invoking the CloudpickleMaterializer.\nFourth, the application executes the unsanitized cloudpickle.load() call on the malicious payload within cloudpickle_materializer.py. Finally, during the deserialization process, the crafted __reduce__ method is evaluated, causing the arbitrary system commands embedded in the payload to execute with the privileges of the running process.\nThe authentication and privilege requirements necessitate that the attacker has write access to the shared artifact store where intermediate pipeline artifacts are persisted. The network exposure corresponds to the accessibility of the shared storage backend and the environments executing the ZenML pipelines.\nThe payload behavior involves triggering OS-level command execution upon instantiation or reconstruction of the malicious Python object during deserialization. The post-exploitation impact includes complete system compromise, unauthorized data exfiltration, lateral movement within the network, and manipulation of subsequent pipeline executions."
}