CVE-2024-28425

Name of the Vulnerable Software and Affected Versions greykite version 1.0.0

Description The issue allows attackers to execute arbitrary code via uploading a crafted file, exploiting an arbitrary file upload vulnerability in the load obj function at /templates/pickle utils.py.

Recommendations For greykite version 1.0.0, consider disabling the load obj function at /templates/pickle utils.py until a patch is available to prevent exploitation of the arbitrary file upload vulnerability. Restrict access to the /templates/pickle utils.py module to minimize the risk of exploitation. Avoid using the vulnerable function to load objects from untrusted sources until the issue is resolved.