PyPI/cleanlab CVE-2024-45857: high 7.8, EPSS 0.24%
Cleanlab Deserialization of Untrusted Data vulnerability
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.4.0 | - | 2.6.6 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-1254
- https://nvd.nist.gov/vuln/detail/CVE-2024-45857
- https://github.com/cleanlab/cleanlab
- https://github.com/cleanlab/cleanlab/blob/v2.6.6/cleanlab/datalab/internal/serialize.py#L102-L138
- https://hiddenlayer.com/sai-security-advisory/2024-09-cleanlab
- https://pypi.org/project/cleanlab
- https://github.com/advisories/GHSA-8cm9-rrgc-4pcj
CVE-2024-45857 · published · modified · JSON