Yzhao062

**Name of the Vulnerable Software and Affected Versions** pyod versions 3.5.0 through 3.5.2 **Description** A deserialization flaw exists in the `pyod.utils.persistence.load()` function within the `pyod/utils/persistence.py` file. The issue occurs because `joblib.load()` is executed before any envelope validation, allowing a remote attacker to trigger arbitrary code execution by manipulating the `path` argument to load an untrusted model file. This specifically impacts machine learning pipelines that load models from user uploads, shared folders, or registries. **Recommendations** Update pyod to a version where the `trusted=True` flag is required for loading. Only load trusted artifacts and verify signatures or checksums. Sandbox loading flows to minimize the risk of execution.