Arbitrary Code Execution in Computer Vision Annotation Tool by CVAT Vendor
CVE-2025-23045

8.7HIGH

Key Information:

Vendor: Cvat-ai
Status: Cvat
Vendor: CVE Published:; 28 January 2025

What is CVE-2025-23045?

An arbitrary code execution vulnerability exists in the Computer Vision Annotation Tool (CVAT) allowing an attacker with an account to execute code within the Nuclio function container. This affects deployments running serverless functions such as TransT and SiamMask, particularly those utilizing unsafe serialization methods. Administrators are urged to upgrade CVAT to version 2.26.0 or higher to mitigate risks. If upgrading is not possible, it is critical to disable any running instances of the affected functions to prevent exploitation.

Affected Version(s)

cvat >= 1.1.0, < 2.26.0

References

https://github.com/cvat-ai/cvat/security/advisories/GHSA-...

x_refsource_CONFIRM

https://github.com/cvat-ai/cvat/commit/563e1dfde64b15fa04...

x_refsource_MISC

CVSS V4

Score:

8.7

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction: