CVE-2025-5173: Label Studio ML Backend Path Traversal

CVE-2025-5173 Overview

CVE-2025-5173 is an insecure deserialization vulnerability in HumanSignal label-studio-ml-backend up to commit 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf. The flaw resides in the load function of label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py, which handles PyTorch (PT) model files. An attacker with local access can manipulate the path argument to trigger unsafe deserialization of an untrusted PT file. Because the project follows a rolling-release model, no fixed version identifier exists. The issue is tracked under [CWE-20] and [CWE-502].

Critical Impact
Local attackers who can influence the PT file path passed to the load function can trigger deserialization of attacker-controlled data, leading to arbitrary code execution in the label-studio-ml-backend process context.

Affected Products

HumanSignal label-studio-ml-backend up to commit 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf
YOLO example module: label_studio_ml/examples/yolo/utils/neural_nets.py
PT File Handler component (load function)

Discovery Timeline

2025-05-26 - CVE-2025-5173 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5173

Vulnerability Analysis

The vulnerability exists in the load function inside label_studio_ml/examples/yolo/utils/neural_nets.py. This function processes PyTorch model files (PT files) supplied via the path argument. PyTorch's default model loading routine relies on Python's pickle module, which deserializes arbitrary object graphs and can execute code contained in reduce callbacks. When the path argument points to an attacker-controlled PT file, the deserialization primitive can be abused to run arbitrary Python code within the ML backend process. The rolling-release nature of the project means downstream users must track commits directly rather than pin to a fixed version.

Root Cause

The root cause is unsafe deserialization of untrusted input [CWE-502] combined with insufficient input validation on the path argument [CWE-20]. The load function does not validate the origin, integrity, or contents of the PT file before invoking a pickle-backed loader.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker who can write to or influence the file path passed into load can plant a crafted PT file containing a malicious pickle payload. When the ML backend loads that file, the payload executes in the backend's process context. See the GitHub issue discussion for additional context.

No verified proof-of-concept code is publicly available.
The vulnerability mechanism is described in prose above.
Refer to the vendor GitHub issue for further technical detail.

Detection Methods for CVE-2025-5173

Indicators of Compromise

Presence of unexpected or untrusted .pt files in directories consumed by label_studio_ml/examples/yolo/utils/neural_nets.py
Child processes spawned by the label-studio-ml-backend Python interpreter that are unrelated to model inference (for example, shells or network utilities)
Modification of the path argument through configuration files, environment variables, or API parameters pointing to attacker-writable locations

Detection Strategies

Monitor file system activity for writes of .pt files to directories referenced by label-studio-ml-backend workloads.
Inspect PT files with static tooling that flags dangerous pickle opcodes such as GLOBAL, REDUCE, and INST before they are loaded.
Correlate model load events with process execution telemetry to detect anomalous child processes from the ML backend.

Monitoring Recommendations

Enable process-level auditing on hosts running label-studio-ml-backend to capture command-line arguments and parent-child process chains.
Log all invocations of the load function and the resolved absolute path of the PT file being deserialized.
Alert on execution of interpreters, package managers, or outbound network tools spawned from the ML backend service account.

How to Mitigate CVE-2025-5173

Immediate Actions Required

Restrict write access to any directory that supplies PT files to label-studio-ml-backend to trusted administrators only.
Run the ML backend under a dedicated, least-privileged service account isolated from other workloads.
Audit existing PT files in model directories and remove any of unknown provenance.
Review GitHub issue #765 for upstream remediation status and pull the latest commit once a fix lands.

Patch Information

HumanSignal uses a rolling-release model, so no fixed version tag is published for CVE-2025-5173. Track the upstream repository and apply commits that address the load function in label_studio_ml/examples/yolo/utils/neural_nets.py. Consult the vendor advisory and VulDB entry #310261 for status updates.

Workarounds

Load PT files only from directories with strict filesystem permissions that block untrusted local users.
Use PyTorch's weights_only=True loading option where feasible to prevent arbitrary object deserialization.
Validate PT files with a pickle scanner before passing them to the load function.
Containerize the ML backend and mount model directories as read-only from a curated source.

bash

# Example: restrict PT model directory to a dedicated service account
sudo chown -R labelstudio:labelstudio /opt/label-studio-ml-backend/models
sudo chmod 750 /opt/label-studio-ml-backend/models
find /opt/label-studio-ml-backend/models -type f -name '*.pt' -exec chmod 640 {} \;

# Run the backend under the least-privileged account
sudo -u labelstudio python _wsgi.py