The Adversarial Robustness Toolbox (ART) up to version 1.20.1 contains an insecure deserialization flaw in its Kubeflow component’s model‑loading procedure. By calling torch.load() without the weights_only=True protection, the code allows arbitrary Python objects to be deserialized via the Pickle module. The likely attack vector is an attacker who can upload a maliciously crafted model file (for example, model.pt) to the object storage referenced by the pipeline, or who can manipulate the model_id parameter to point to such a file. When the pipeline loads the model, the payload is executed, providing remote code execution privileges. Based on the description, the attacker must possess the ability to influence the model source—either by placing a malicious file in storage or by controlling the model_id reference. The effect is execution of arbitrary code in the process that runs the Kubeflow pipeline, potentially compromising the host, data, and any downstream services. The impact of this flaw is therefore a high‑severity Remote Code Execution risk, as the malicious code can run with the same permissions as the pipeline execution environment.

This vulnerability affects any deployment of the ART library that utilizes the Kubeflow component for model loading, specifically when performing robustness evaluations from model files sourced via external object storage. The flaw exists in ART versions up to 1.20.1 and is mitigated in any subsequent release that enforces the weights_only=True restriction. No specific third‑party vendor is cited; the issue is tied to the ART codebase itself.

The CVSS score of 9.8 highlights a critical severity, and the EPSS score of < 1% indicates a very low but nonzero probability of exploitation. The description confirms remote code execution when an attacker supplies or references a malicious model file, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation reported publicly at this time. Nonetheless, the potential for widespread compromise warrants immediate attention, especially in environments that dynamically source model artifacts from shared repositories.