CVE-2026-63767

Name of the Vulnerable Software and Affected Versions ktransformers versions prior to 0.6.3 commit def0f93

Description An unauthenticated pickle deserialization issue exists where remote attackers can execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. This is achieved by exploiting malicious reduce methods embedded in the payloads, allowing shell commands to be executed with the privileges of the server process. Pickle deserialization is the process of converting a byte stream back into a Python object, which can be dangerous if the data source is untrusted.

Recommendations Update ktransformers to the version containing commit def0f93.