CVE-2025-54413

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsistency in MethodNode, which can be exploited to access unexpected object fields through dot notation. This can be used to achieve arbitrary code execution at load time. While this issue may seem similar to GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types. This is fixed in version 12.0.0.

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsistency in MethodNode, which can be exploited to access unexpected object fields through dot notation. This can be used to achieve arbitrary code execution at load time. While this issue may seem similar to GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types. This is fixed in version 12.0.0.

Summary

An inconsistency in MethodNode can be exploited to access unexpected object fields through dot notation. This can be used to achieve arbitrary code execution at load time.

While this issue may seem similar to https://github.com/skops-dev/skops/security/advisories/GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types.

Details

The MethodNode allows access to attributes of existing objects via dot notation. However, there are several critical shortcomings:

• Although the __class__ and __module__ fields are checked via get_untrusted_types and during the load phase (as a concatenated string), they are not actually used by MethodNode. Instead, the func and obj entries in the schema.json are used to determine behavior. This means that even an apparently harmless __module__.__class__ pair can lead to access of arbitrary attributes or methods of loaded objects, without any additional checks.

• Nothing prevents an attacker from chaining multiple MethodNode instances to traverse the object hierarchy and access harmful attributes.

An object can be loaded using the ObjectNode, which normally enforces strict checks and allows only trusted or explicitly permitted objects. However, once the object is loaded, dot notation can be used to access any of its attributes or methods. Furthermore, by chaining multiple MethodNodes, one can traverse the Python object hierarchy and reach dangerous components such as the builtins dictionary—which contains functions like exec and eval.

This vulnerability allows the attacker to bypass both get_untrusted_types and load checks, enabling access to dangerous attributes and methods without triggering any alerts. As demonstrated in the PoC, arbitrary code execution is possible using just an anonymous object returned by get_untrusted_types (in the example, builtins.int, though any type would suffice since it doesn't influence the exploit).

For example, consider a malicious schema.json snippet like:

...
"__class__": "int",
"__module__": "builtins",
"__loader__": "MethodNode",
"content": {
  "obj": {
    "__class__": "int",
    "__module__": "builtins",
    "__loader__": "MethodNode",
    "content": {
      "obj": {
        "__class__": "QuadraticDiscriminantAnalysis",
        "__module__": "sklearn.discriminant_analysis",
        "__loader__": "ObjectNode",
        "__id__": 1
      },
      "func": "decision_function"
    }
  },
  "func": "__builtins__"
}
...

Here, the attacker loads a trusted QuadraticDiscriminantAnalysis object using ObjectNode, accesses its decision_function method via MethodNode, and then uses another MethodNode to access the __builtins__ dictionary—all without triggering the untrusted type detection mechanisms.

Proof of Concept (PoC)

The provided PoC demonstrates arbitrary code execution using only builtins.int as the type returned by get_untrusted_types and verified by load. Note that the actual type is fully controlled by the attacker and can be anything (e.g., provola.whatever), as it's not used by skops or the exploit.

Components Used in the Exploit

To craft the exploit, the following skops nodes are used:

• MethodNode – to silently access arbitrary Python attributes via dot notation. This is the vulnerable core.
• ObjectNode – to load a trusted object and use it as a base to access its attributes and methods. Also used to set object state via __setstate__.
• PartialNode – to easily control arguments passed to functions accessed.
• DefaultDictNode – to store a crafted call to exec using the default_factory attribute.
• DictNode – to trigger the call at load time.
• JsonNode, TypeNode, ListNode, etc. – for basic types, structures, and constants.

Additionally, the interesting implementation of GridSearchCV.score was leveraged, specifically:…

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsistency in MethodNode, which can be exploited to access unexpected object fields through dot notation. This can be used to achieve arbitrary code execution at load time. While this issue may seem similar to GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types. This is fixed in version 12.0.0.

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsistency in MethodNode, which can be exploited to access unexpected object fields through dot notation. This can be used to achieve arbitrary code execution at load time. While this issue may seem similar to GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types. This is fixed in version 12.0.0.

Summary

An inconsistency in MethodNode can be exploited to access unexpected object fields through dot notation. This can be used to achieve arbitrary code execution at load time.

While this issue may seem similar to https://github.com/skops-dev/skops/security/advisories/GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types.

Details

The MethodNode allows access to attributes of existing objects via dot notation. However, there are several critical shortcomings:

• Although the __class__ and __module__ fields are checked via get_untrusted_types and during the load phase (as a concatenated string), they are not actually used by MethodNode. Instead, the func and obj entries in the schema.json are used to determine behavior. This means that even an apparently harmless __module__.__class__ pair can lead to access of arbitrary attributes or methods of loaded objects, without any additional checks.

• Nothing prevents an attacker from chaining multiple MethodNode instances to traverse the object hierarchy and access harmful attributes.

An object can be loaded using the ObjectNode, which normally enforces strict checks and allows only trusted or explicitly permitted objects. However, once the object is loaded, dot notation can be used to access any of its attributes or methods. Furthermore, by chaining multiple MethodNodes, one can traverse the Python object hierarchy and reach dangerous components such as the builtins dictionary—which contains functions like exec and eval.

This vulnerability allows the attacker to bypass both get_untrusted_types and load checks, enabling access to dangerous attributes and methods without triggering any alerts. As demonstrated in the PoC, arbitrary code execution is possible using just an anonymous object returned by get_untrusted_types (in the example, builtins.int, though any type would suffice since it doesn't influence the exploit).

For example, consider a malicious schema.json snippet like:

...
"__class__": "int",
"__module__": "builtins",
"__loader__": "MethodNode",
"content": {
  "obj": {
    "__class__": "int",
    "__module__": "builtins",
    "__loader__": "MethodNode",
    "content": {
      "obj": {
        "__class__": "QuadraticDiscriminantAnalysis",
        "__module__": "sklearn.discriminant_analysis",
        "__loader__": "ObjectNode",
        "__id__": 1
      },
      "func": "decision_function"
    }
  },
  "func": "__builtins__"
}
...

Here, the attacker loads a trusted QuadraticDiscriminantAnalysis object using ObjectNode, accesses its decision_function method via MethodNode, and then uses another MethodNode to access the __builtins__ dictionary—all without triggering the untrusted type detection mechanisms.

Proof of Concept (PoC)

The provided PoC demonstrates arbitrary code execution using only builtins.int as the type returned by get_untrusted_types and verified by load. Note that the actual type is fully controlled by the attacker and can be anything (e.g., provola.whatever), as it's not used by skops or the exploit.

Components Used in the Exploit

To craft the exploit, the following skops nodes are used:

• MethodNode – to silently access arbitrary Python attributes via dot notation. This is the vulnerable core.
• ObjectNode – to load a trusted object and use it as a base to access its attributes and methods. Also used to set object state via __setstate__.
• PartialNode – to easily control arguments passed to functions accessed.
• DefaultDictNode – to store a crafted call to exec using the default_factory attribute.
• DictNode – to trigger the call at load time.
• JsonNode, TypeNode, ListNode, etc. – for basic types, structures, and constants.

Additionally, the interesting implementation of GridSearchCV.score was leveraged, specifically:…

Summary

An inconsistency in MethodNode can be exploited to access unexpected object fields through dot notation. This can be used to achieve arbitrary code execution at load time.

While this issue may seem similar to https://github.com/skops-dev/skops/security/advisories/GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types.

Details

The MethodNode allows access to attributes of existing objects via dot notation. However, there are several critical shortcomings:

• Although the __class__ and __module__ fields are checked via get_untrusted_types and during the load phase (as a concatenated string), they are not actually used by MethodNode. Instead, the func and obj entries in the schema.json are used to determine behavior. This means that even an apparently harmless __module__.__class__ pair can lead to access of arbitrary attributes or methods of loaded objects, without any additional checks.

• Nothing prevents an attacker from chaining multiple MethodNode instances to traverse the object hierarchy and access harmful attributes.

An object can be loaded using the ObjectNode, which normally enforces strict checks and allows only trusted or explicitly permitted objects. However, once the object is loaded, dot notation can be used to access any of its attributes or methods. Furthermore, by chaining multiple MethodNodes, one can traverse the Python object hierarchy and reach dangerous components such as the builtins dictionary—which contains functions like exec and eval.

This vulnerability allows the attacker to bypass both get_untrusted_types and load checks, enabling access to dangerous attributes and methods without triggering any alerts. As demonstrated in the PoC, arbitrary code execution is possible using just an anonymous object returned by get_untrusted_types (in the example, builtins.int, though any type would suffice since it doesn't influence the exploit).

For example, consider a malicious schema.json snippet like:

...
"__class__": "int",
"__module__": "builtins",
"__loader__": "MethodNode",
"content": {
  "obj": {
    "__class__": "int",
    "__module__": "builtins",
    "__loader__": "MethodNode",
    "content": {
      "obj": {
        "__class__": "QuadraticDiscriminantAnalysis",
        "__module__": "sklearn.discriminant_analysis",
        "__loader__": "ObjectNode",
        "__id__": 1
      },
      "func": "decision_function"
    }
  },
  "func": "__builtins__"
}
...

Here, the attacker loads a trusted QuadraticDiscriminantAnalysis object using ObjectNode, accesses its decision_function method via MethodNode, and then uses another MethodNode to access the __builtins__ dictionary—all without triggering the untrusted type detection mechanisms.

Proof of Concept (PoC)

The provided PoC demonstrates arbitrary code execution using only builtins.int as the type returned by get_untrusted_types and verified by load. Note that the actual type is fully controlled by the attacker and can be anything (e.g., provola.whatever), as it's not used by skops or the exploit.

Components Used in the Exploit

To craft the exploit, the following skops nodes are used:

• MethodNode – to silently access arbitrary Python attributes via dot notation. This is the vulnerable core.
• ObjectNode – to load a trusted object and use it as a base to access its attributes and methods. Also used to set object state via __setstate__.
• PartialNode – to easily control arguments passed to functions accessed.
• DefaultDictNode – to store a crafted call to exec using the default_factory attribute.
• DictNode – to trigger the call at load time.
• JsonNode, TypeNode, ListNode, etc. – for basic types, structures, and constants.

Additionally, the interesting implementation of GridSearchCV.score was leveraged, specifically:…