Description

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipulation of the argument fname causes deserialization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Maintainer closed #3663 same-day with no comment, PR, or fix; repo's last push (2025-11-01) predates the report, so the unsafe pickle.load in SaveLoad.load remains unguarded at develop HEAD.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-20T23:17:02.977Z",
  "pubdate": "2026-09-20T23:17:02.977Z",
  "executiveSummary": "A critical deserialization vulnerability exists in the gensim library up to version 4.4.0, specifically within the Model Loader component. The issue stems from the unsafe use of Python's pickle module when processing the fname argument in the Load function within gensim/utils.py.\nThis vulnerability allows an unauthenticated, remote attacker to achieve arbitrary code execution on the host system. By supplying a maliciously crafted file to the vulnerable loader, an attacker can trigger the execution of arbitrary commands during the deserialization process.\nThe risk is categorized as high, as the exploit is publicly available and the library currently lacks a patch at the develop HEAD. The vulnerability is persistent, and the lack of input validation or secure deserialization practices exposes any application utilizing gensim to load untrusted model files to immediate compromise.\nNo authentication or specific privileges are required to initiate this attack, provided the attacker can influence the file path loaded by the application. Organizations must treat all model files from untrusted sources as potentially malicious and implement strict access controls.",
  "technicalDetails": "The root cause of this vulnerability is the implementation of the Load function within gensim/utils.py, which utilizes the insecure pickle.load() method to reconstruct Python objects from serialized data. The pickle module is inherently insecure when processing data from untrusted sources, as it can be leveraged to instantiate arbitrary objects and execute arbitrary code through the __reduce__ method of a serialized class.\nThe vulnerability exists in the SaveLoad.load mechanism, which facilitates the loading of saved Gensim models. When the function receives a path to a malicious file via the fname argument, it attempts to deserialize the content without sanitization or signature verification. An attacker can craft a pickle payload that, when interpreted by the Python interpreter, executes system-level commands as the user running the Gensim process.\nThe attack flow proceeds as follows: First, the attacker creates a malicious serialized object containing a payload designed to execute system commands (e.g., via the subprocess or os modules). Second, the attacker distributes this file, ensuring it is accessible to the vulnerable target application. Third, the attacker triggers the application to call the Load function, passing the path to the malicious file. Finally, upon invocation of pickle.load() on the malicious stream, the Python interpreter deserializes the object, triggering the execution of the attacker-supplied payload with the effective permissions of the target application.\nThis vulnerability is classified as an insecure deserialization issue. Because the application logic relies on the integrity of the input file to remain safe, it is effectively vulnerable to remote code execution. The lack of architectural safeguards in the current Gensim codebase, specifically the omission of integrity checks or the use of safer serialization formats like JSON or Protocol Buffers, ensures that the flaw persists. Since the maintainer has not provided a formal patch and the develop branch remains unchanged, users remain exposed unless they adopt external remediation strategies."
}