Description
A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | wandb | 0.25.2.dev1 | — |
References
- VDB-378114 | wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash vdb-entry technical-description
- VDB-378114 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-15605 | CVE Analysis and Report third-party-advisory
- Submit #855675 | Weights & Biases wandb 0.25.2.dev1 at commit 28cc0bf5a9b529b72e5e501d0a48c6c42220ae0a; earlier versions may be affected if they use the same MD5-based CWE-328 Use of Weak Hash third-party-advisory
- https://github.com/wandb/wandb/issues/12030 issue-tracking
- https://github.com/wandb/wandb/pull/12031 issue-tracking patch
- https://github.com/wandb/wandb/ product