CVE-2025-23045 is a critical (CVSS 9.8 in NVD) deserialization flaw in CVAT, the Computer Vision Annotation Tool. An attacker with an account can run code inside the Nuclio function container when tracker functions such as TransT or SiamMask are deployed. The fix is CVAT 2.26.0 or later.
What's affected
The GitHub advisory GHSA-wq36-mxf8-hv62 lists CVAT versions 1.1.0 through 2.25.0 as affected, with 2.26.0 patched. GitHub rates it High at 8.7 under CVSS 4.0, while the NVD record scores it 9.8 under CVSS 3.1.
Only deployments that run serverless functions of type tracker from the CVAT Git repository are affected, namely TransT and SiamMask. Deployments with custom tracker functions may also be affected, depending on how they handle state serialization. The advisory says that a function using an unsafe serialization library such as pickle or jsonpickle is likely to be vulnerable.
How to check if you're exposed
Check your CVAT version and whether tracker functions are deployed:
nuctl get function
docker ps | grep -i cvat
If the list includes pth-dschoerk-transt or pth-foolwood-siammask, the built in tracker functions are running. Also review any custom functions your team wrote that restore tracking state, and look for pickle or jsonpickle in their code.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade CVAT to 2.26.0 or later. The advisory says you do not need to change or redeploy the Nuclio functions afterwards.
- If you cannot upgrade yet, shut down TransT and SiamMask with the nuctl delete function commands given in the advisory.
- Audit custom tracker functions and make sure the code that restores tracking state cannot be fed malicious input.
- Limit who can create accounts on your CVAT instance, since the attacker needs one.
- Run the Nuclio function containers with the least privileges and network access they need.
Why it matters
CWE-502 is deserialization of untrusted data. Python's pickle format can execute code while loading, so reading a pickle supplied by a user is equivalent to running their code. The tracker functions saved and restored tracking state in a form that an authenticated user could influence.
The result is code execution in the function container, not necessarily on the host, but containers often hold models, data and network reach worth protecting. The safe pattern is to serialize state in a data only format. The KEV flag for this CVE is false and the advisory does not claim exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I have to be running TransT or SiamMask?
The advisory says the built in exposure is in those tracker functions. Custom tracker functions may also be affected if they use unsafe serialization.
What if I cannot upgrade?
Shut down the TransT and SiamMask function instances using the nuctl commands in the advisory, and check any custom tracker code.
Sources
Last reviewed: 19 October 2026.
