The vulnerability lies in the load functions of stable-baselines3, where they deserialize data using Python’s pickle without proper validation. Pickle deserialization is known to execute arbitrary code present in the payload, thus an attacker can craft a malicious file to achieve remote code execution. The weakness is classified under CWE-20 and CWE-502, indicating improper input validation and unsafe deserialization of untrusted data. The public disclosure and the fact that the exploit is available make the threat real and actionable for services that load models from untrusted sources.

All installations of the DLR‑RM stable‑baselines3 library prior to the hardening fix are affected. Specifically the PO load, load_replay_buffer, and VecNormalize.load functions in CPython files under save_util.py can be triggered with an attacker‑provided file. Versions up to 2.9.0, as well as later releases that reverted the hardening patch (via PR #1913), remain vulnerable. Users relying on more recent releases that incorporate PR #2264 should verify that the loading path has been hardened (weights_only=True).

The CVSS score of 5.3 assigns moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation yet. Nonetheless, because the attack vector is remote—an attacker can supply a malicious pickle file to any code that calls the vulnerable load functions—the risk can be significant if the target system imports or processes an untrusted file. Exploitation requires the ability to run the vulnerable library, so an application that accepts user‑supplied models or buffers is a potential entry point. In the absence of additional mitigation, a successful exploit can lead to full remote code execution on the host running the Python process.