The vulnerability resides in the RedisCache function of datapizza-ai 0.0.2 and allows an attacker to manipulate data that is subsequently deserialized, which could lead to execution of arbitrary code. The CVSS 2.1 score indicates a low overall risk, but the nature of deserialization attacks means that a successful exploitation could compromise the system’s integrity if payloads are accepted from an attacker-controlled source. The description emphasizes that the exploit is difficult to perform, requiring local network access and a high level of complexity.

Datapizza-labs’ datapizza-ai version 0.0.2 is affected, specifically the RedisCache implementation located in datapizza-ai‑cache/redis/datapizza/cache/redis/cache.py. No other versions or products are listed as vulnerable in the current data.

The exploitation probability is very low, with an EPSS score of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to be on the local network and involves high complexity, indicating that a successful compromise would most likely stem from a privileged local user or a compromised device within the same network segment. Because the vendor’s response was non‑existent, there is currently no official fix, which increases the importance of mitigating the attack surface and monitoring for any future patch or advisory.