Vulnerabilities for skops

First version without a known vulnerability: 0.13.0

Details

• GHSA-378x-6p4f-8jgm2025-08-07

  SKOPS Card.get_model happily allows arbitrary code execution

  Fixed in: 0.13.0

• GHSA-4v6w-xpmh-gfgp2025-07-25

  Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time

  Fixed in: 0.12.0

• GHSA-m7f4-hrc6-fwg32025-07-25

  Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution

  Fixed in: 0.12.0

• GHSA-q49c-6v6g-wgq32024-06-04

  Skops unsafe deserialization