Vulnerability Description
An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
- https://github.com/esa/AnomalyMatch/pull/9
- https://imlabs.info/research/security_advisory_esa_anomaly_match_unsafe_deserial
FAQ
What is CVE-2026-38950?
CVE-2026-38950 is a vulnerability with a CVSS score of 7.8 (HIGH). An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.lo...
How severe is CVE-2026-38950?
CVE-2026-38950 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-38950?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.