Arbitrary Code Execution in Computer Vision Annotation Tool by CVAT Vendor
CVE-2025-23045

8.7HIGH

Key Information:

Vendor

Cvat-ai

Status
Cvat
Vendor
CVE Published:
28 January 2025

What is CVE-2025-23045?

An arbitrary code execution vulnerability exists in the Computer Vision Annotation Tool (CVAT) allowing an attacker with an account to execute code within the Nuclio function container. This affects deployments running serverless functions such as TransT and SiamMask, particularly those utilizing unsafe serialization methods. Administrators are urged to upgrade CVAT to version 2.26.0 or higher to mitigate risks. If upgrading is not possible, it is critical to disable any running instances of the affected functions to prevent exploitation.

Affected Version(s)

cvat >= 1.1.0, < 2.26.0

References

https://github.com/cvat-ai/cvat/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/cvat-ai/cvat/commit/563e1dfde64b15fa04...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.