CVE-2020-13092 describes a critical deserialization vulnerability in scikit-learn (sklearn) versions up to 0.23.0, allowing arbitrary command execution when an untrusted file containing a malicious __reduce__ method is passed to joblib.load(). This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While the vendor disputes this as a vulnerability, citing joblib.load()'s documented insecurity, the high FAUCET Risk Score of 93/100 and significant community discussion (10 mentions) indicate its potential for misuse. Currently, there is no evidence of active exploitation, nor are there publicly available Metasploit, Nuclei, or ExploitDB modules.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.23.0CPE matchmatch criteria | cpe:2.3:a:scikit-learn:scikit-learn:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.