CVE-2025-23045 in cvat
Summary
by MITRE • 01/28/2025
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run any of the serverless functions of type tracker from the CVAT Git repository, namely TransT and SiamMask. Deployments with custom functions of type tracker may also be affected, depending on how they handle state serialization. If a function uses an unsafe serialization library such as pickle or jsonpickle, it's likely to be vulnerable. Upgrade to CVAT 2.26.0 or later. If you are unable to upgrade, shut down any instances of the TransT or SiamMask functions you're running.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2025
The Computer Vision Annotation Tool (CVAT) vulnerability CVE-2025-23045 represents a critical remote code execution flaw that exploits the serverless function infrastructure within CVAT deployments. This vulnerability specifically targets the tracker functions including TransT and SiamMask that are part of the standard CVAT Git repository. The flaw allows authenticated attackers with existing accounts to escalate their privileges and execute arbitrary code within the Nuclio function container context, effectively compromising the entire annotation environment. The vulnerability stems from unsafe serialization practices within these tracker functions, creating a pathway for malicious code injection that bypasses normal access controls and authorization mechanisms.
The technical implementation of this vulnerability leverages the unsafe handling of state serialization within the affected tracker functions. When these functions process annotation data, they utilize serialization libraries such as pickle or jsonpickle that do not properly validate or sanitize input data during deserialization processes. This unsafe serialization pattern creates a direct code execution vector where maliciously crafted input can be deserialized and interpreted as executable code within the function container. The vulnerability manifests through the Nuclio serverless framework's function execution environment, where the serialized state data is loaded without proper security checks, allowing attackers to inject malicious payloads that execute with the privileges of the function container.
The operational impact of CVE-2025-23045 extends beyond simple privilege escalation to encompass complete system compromise of CVAT deployments. An attacker who gains access to any user account can leverage this vulnerability to gain unauthorized code execution capabilities, potentially leading to data exfiltration, system infiltration, or further network exploitation. The risk is particularly severe in collaborative environments where multiple users access CVAT for annotation tasks, as any compromised account could provide an attacker with a foothold to execute arbitrary code on the annotation infrastructure. This vulnerability affects not only the core annotation functionality but also the underlying serverless infrastructure that powers automated tracking capabilities.
Organizations affected by this vulnerability should implement immediate mitigations while planning for the mandatory upgrade to CVAT 2.26.0 or later versions that contain the appropriate fixes for the serialization issues. The recommended immediate action includes disabling the TransT and SiamMask functions if upgrading is not immediately possible, as these specific function types are confirmed to be vulnerable. This mitigation strategy aligns with the principle of least privilege and reduces the attack surface by eliminating the vulnerable serverless function execution paths. Security teams should also monitor for any unauthorized access attempts or unusual function execution patterns that might indicate exploitation attempts, as the vulnerability operates at the container level and may not be immediately visible through standard network monitoring tools.
This vulnerability demonstrates the critical importance of secure coding practices in serverless environments, particularly around serialization and deserialization operations. The flaw aligns with CWE-502 which addresses unsafe deserialization issues, and represents a significant concern for the ATT&CK framework's execution tactics where adversaries leverage application vulnerabilities to run malicious code. The attack surface is particularly concerning given that CVAT is commonly used in security-sensitive environments including defense and intelligence applications where the compromise of annotation infrastructure could have far-reaching implications for data integrity and operational security. Organizations should review their serverless function implementations and ensure that all state serialization uses secure, validated libraries that properly handle untrusted input data.