The flaw is an unauthenticated pickle deserialization vulnerability that lets a remote attacker execute arbitrary shell commands on the host running the ktransformers SchedulerServer. By crafting a pickle payload that includes a malicious __reduce__ method, an attacker can cause the server’s ZMQ ROUTER socket handler to deserialize the payload and run the command as the process owner. The weakness is a classic deserialization flaw (CWE‑502).

Affected systems include the ktransformers component of kvcache‑ai, specifically all releases through version 0.6.3. The vulnerability is present in the SchedulerServer module that exposes a ZMQ ROUTER socket bound to all network interfaces. The fix is applied in commit def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca. Organizations running versions 0.6.3 or earlier are vulnerable, regardless of deployment mode or environment, as long as the ZMQ interface is reachable.

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of less than 1% suggests a low current exploitation probability. It is not listed in CISA KEV. The likely attack vector is an unauthenticated network connection to the SchedulerServer ZMQ ROUTER socket listening on all interfaces; an attacker can send a crafted pickle payload containing malicious __reduce__ methods, which the server deserializes and executes as the process owner, enabling arbitrary command execution on the host.