Remote Code Execution Vulnerability in Feast by Feast Dev

CVE-2025-11157

What is CVE-2025-11157?

A remote code execution vulnerability has been identified in Feast version 0.53.0, specifically within the Kubernetes materializer job. This flaw stems from improper deserialization practices using yaml.load(...), allowing potential adversaries to manipulate the feature store and materialization configuration files. If an attacker can modify these YAML files, they can execute arbitrary OS commands on the worker pod, which could lead to severe consequences such as cluster takeover, data poisoning, and even supply-chain sabotage. It is crucial for organizations utilizing this software to implement immediate security measures to mitigate this risk.

References