GitHub Advisoryadvisory · PyPI

GHSA-57hm-8rjv-498w ml-logger deserialization vulnerability

LOW Published 2025-09-25 Modified 2025-09-25 Official page ↗
Aliases
CVE-2025-10950
Ecosystem
PyPI
Packages
ml-logger
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-20, CWE-502
Reviewed
2025-09-25

Affected packages

• PyPI ml-logger: <= 0.10.36 (no fix yet)

Description

A vulnerability was determined in geyang ml-logger 0.10.36 and prior. Affected is the function log_handler of the file ml_logger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Related

Alias · CVE (1)

  • CVE-2025-10950 A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References