ZenML CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH ZenML CVE published 2026-08-07

CVE-2026-68772

CVE-2026-68772 is a remote code execution vulnerability in the CloudpickleMaterializer component of ZenML 0.94.6. Attackers with write access to a shared artifact store can execute arbitrary code by planting a malicious pickle file. The vulnerability is triggered when any user or pipeline materializes the artifact through the unsanitized cloudpickle.load() call in cloudpickle_materializer.py.