Coordinated Disclosure Timeline

  • 2025-10-03: Sent the report to NVIDIA using Intigriti’s platform. Report triaged by the Intigriti team.
  • 2025-10-08: Report forwarded to the NVIDIA team.
  • 2025-12-11: Question about the patch.
  • 2026-01-14: Reminder about the disclosure deadline.
  • 2026-07-22: Submission has been disclosed in bulletin https://nvidia.custhelp.com/app/answers/detail/a_id/5739 and assigned CVE-2025-33214

Summary

NVTabular v23.08.00 is affected by an insecure deserialization vulnerability in the Workflow.load method (GHSL-2025-115), which could allow an attacker to execute arbitrary code.

Project

NVTabular

Tested Version

v23.08.00

Details

Insecure deserialization in Workflow.load (GHSL-2025-115)

The load function loads models with cloudpickle.load. Loading potentially malicious models (e.g. when sharing models between researchers) using cloudpickle.load can lead to insecure deserialization.

Similarly to the previous vulnerability report from ZDI affecting the load_model_trainer_states_from_checkpoint function, loading potentially malicious models could lead to remote code execution.

    def load(cls, path: Union[str, os.PathLike], client=None) -> "Workflow":
        # snip

        path = str(path)

        fs = fsspec.get_fs_token_paths(path)[0]

        # snip

        workflow = cloudpickle.load(fs.open(fs.sep.join([path, "workflow.pkl"]), "rb"))

CWEs

  • CWE-502: Deserialization of Untrusted Data

Impact

This issue may lead to remote code execution.

Resources

CVE

  • CVE-2025-33214

Credit

This issue was discovered and reported by GHSL team member @sylwia-budzynska (Sylwia Budzynska).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2025-115 in any communication regarding this issue.