SB2025012872 - Deserialization of Untrusted Data in Computer Vision Annotation Tool (CVAT)

Description

This security bulletin contains information about 1 vulnerability.

1) Deserialization of Untrusted Data (CVE-ID: CVE-2025-23045)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in tracker Nuclio functions when restoring serialized tracking state. A remote user can supply crafted serialized state data to execute arbitrary code.

This affects deployments running tracker functions such as TransT and SiamMask, and may also affect custom tracker functions depending on how they handle state serialization.

Remediation

Install update from vendor's website.

References

• https://github.com/cvat-ai/cvat/security/advisories/GHSA-wq36-mxf8-hv62
• https://github.com/cvat-ai/cvat/commit/563e1dfde64b15fa042b23f9d09cd854b35f0366