{"action":"Upgrade scikit-learn to 0.23.1 or later.","affected":[{"fixed":"0.23.1","introduced":"0"}],"component":"scikit-learn","cve_ids":["CVE-2020-13092"],"ecosystem":"PyPI","epss":0.03406,"exploited":false,"fixed_versions":["0.23.1"],"ghsa_id":"GHSA-jjw5-xxj6-pcv5","id":"tcs_01M5KG9ATT5ZW3N672YP9RPX11","modified_at":"2026-06-10T17:02:41.393980472Z","published_at":"2020-05-15T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-107","https://github.com/0FuzzingQ/vuln/blob/master/sklearn%20unserialize.md","https://scikit-learn.org/stable/modules/model_persistence.html#security-maintainability-limitations","https://github.com/advisories/GHSA-jjw5-xxj6-pcv5"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-107","url":"https://osv.dev/vulnerability/PYSEC-2020-107"}],"summary":"** DISPUTED ** scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if __reduce__ makes an os.system call"}