Skip to content
OpenAdvisories

Package · PyPI

ludwig

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2026-31237

    Ludwig framework is vulnerable to insecure deserialization through its predict() method.

    The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method. When a user provides a dataset file path to the predict() method, the framework automatically determines the file format. If the file is a pickl…

    ludwig PyPI
  • Critical 9.8
    CVE-2026-31238

    Ludwig framework is vulnerable to insecure deserialization in its model serving component

    The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component. When starting a model server with the ludwig serve command, the framework loads model weight files using torch.load() without enabling the sec…

    ludwig PyPI