The vulnerability arises from an unsafe deserialization process in the CloudpickleMaterializer component of ZenML 0.94.6. An attacker who can write to the shared artifact store can replace an existing artifact.pkl file with a crafted cloudpickle payload that contains a malicious __reduce__ method. When any user or pipeline materializes the artifact, the unsanitized cloudpickle.load() call executes the payload, allowing arbitrary system commands to run with the permissions of the ZenML process. The weakness is listed as CWE‑502 and the CVSS score is 8.5, indicating a high risk for confidentiality, integrity, and availability of affected systems.

ZenML, version 0.94.6. Any deployment that uses the default CloudpickleMaterializer to read artifacts from an external or shared artifact store is potentially vulnerable. No other product versions were identified as affected based on the information provided.

Because an attacker only needs write access to the artifact store, the attack surface is limited to environments where store permissions are not tight. The EPSS score is unavailable, but the high CVSS indicates a serious threat. The vulnerability is not listed in the CISA KEV catalog, but the lack of a KEV listing does not diminish the need for remediation. If exploited, the attacker can execute arbitrary code on the host running ZenML, potentially taking full control over the system.