PyPI/skops CVE-2025-54412: high 8.7, EPSS 0.15%

Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution

Action: Upgrade skops to 0.12.0 or later.

pip install skops==0.12.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1927
• nvd: CVE-2025-54412
• https://github.com/skops-dev/skops/security/advisories/GHSA-m7f4-hrc6-fwg3
• https://github.com/skops-dev/skops/commit/0aeca055509dfb48c1506870aabdd9e247adf603
• https://drive.google.com/file/d/1c2KrjayE_S1siaou0vDmGK7_MQ7_YCUZ/view?usp=sharing
• https://github.com/io-no/CVE-Reports/tree/main/CVE-2025-54412
• https://github.com/skops-dev/skops
• https://github.com/skops-dev/skops/releases/tag/v0.12.0
• https://pypi.org/project/skops
• https://github.com/advisories/GHSA-m7f4-hrc6-fwg3

CVE-2025-54412 · published 2026-07-07T16:02:58.868366Z · modified 2026-07-07T17:47:54.152174830Z · JSON