CVE-2025-57622: Step-Video-T2V RCE Vulnerability

CVE-2025-57622 Overview

CVE-2025-57622 is an insecure deserialization vulnerability in Step-Video-T2V, an AI-powered text-to-video generation framework. The vulnerability allows remote attackers to execute arbitrary code by exploiting unsafe use of Python's pickle.loads() function within the /vae-api and /caption-api endpoints. When the application processes incoming request data through pickle.loads(request.get_data()), it deserializes untrusted user input without proper validation, enabling attackers to craft malicious pickle payloads that execute arbitrary code upon deserialization.

Critical Impact

Remote attackers can achieve full code execution on systems running Step-Video-T2V by sending specially crafted pickle payloads to exposed API endpoints, potentially compromising the entire server infrastructure.

Affected Products

• Step-Video-T2V (stepfun-ai/Step-Video-T2V)
• Systems exposing /vae-api endpoint
• Systems exposing /caption-api endpoint

Discovery Timeline

• 2026-03-03 - CVE-2025-57622 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2025-57622

Vulnerability Analysis

This vulnerability represents a classic insecure deserialization flaw in Python applications. The Step-Video-T2V application utilizes the pickle module to deserialize data received from HTTP requests. Python's pickle module is inherently unsafe when processing untrusted data because it can execute arbitrary Python code during the deserialization process.

The vulnerable code pattern pickle.loads(request.get_data()) directly deserializes raw request data without any validation, sanitization, or integrity checks. This allows an attacker to construct a malicious pickle payload containing embedded Python code that executes when the server deserializes the request.

Root Cause

The root cause of this vulnerability is the use of Python's pickle.loads() function to deserialize untrusted user input from HTTP requests. The pickle module was never designed to be secure against malicious or erroneous data. According to Python's official documentation, pickle can execute arbitrary code during unpickling, making it unsuitable for deserializing data from untrusted sources.

The vulnerable component in call_remote_server.py accepts raw HTTP request data and passes it directly to pickle.loads(), creating a direct path for remote code execution. There is no input validation, type checking, or use of safer serialization alternatives such as JSON.

Attack Vector

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to either the /vae-api or /caption-api endpoints. The attack involves constructing a malicious pickle payload that leverages Python's __reduce__ method to execute arbitrary commands when deserialized.

The exploitation process follows these steps:

1. The attacker crafts a malicious pickle object that, when deserialized, executes arbitrary Python code or system commands
2. The payload is sent as the raw body of an HTTP request to one of the vulnerable endpoints
3. The server receives the request and calls pickle.loads() on the request data
4. During deserialization, the malicious payload triggers code execution in the context of the application

This attack is network-based and requires no authentication or user interaction. For technical details on the vulnerable code, refer to the source code on GitHub and the related GitHub Issue #65.

Detection Methods for CVE-2025-57622

Indicators of Compromise

• Unexpected outbound network connections from Step-Video-T2V server processes
• Unusual process spawning or shell execution from Python processes handling API requests
• Suspicious HTTP POST requests to /vae-api or /caption-api endpoints with non-standard content types
• Unexpected file system modifications or new files created by the application process

Detection Strategies

• Monitor HTTP traffic for POST requests to /vae-api and /caption-api endpoints containing binary pickle data signatures (typically starting with \\x80\\x04\\x95 for protocol 4)
• Implement application-level logging to capture all deserialization events and flag requests that trigger code execution
• Deploy endpoint detection solutions to identify anomalous process behavior following API requests
• Use network intrusion detection to identify pickle-based exploitation attempts

Monitoring Recommendations

• Enable verbose logging on the Step-Video-T2V application to capture all incoming API requests
• Monitor for unusual CPU or memory utilization patterns that may indicate exploitation
• Set up alerts for any child processes spawned by the API server process
• Review web server access logs for requests to the affected endpoints with unusual payload sizes

How to Mitigate CVE-2025-57622

Immediate Actions Required

• Restrict network access to the /vae-api and /caption-api endpoints using firewall rules or network segmentation
• Disable or shut down exposed Step-Video-T2V API services until a patch is available
• Implement a web application firewall (WAF) rule to block requests to the affected endpoints
• Review system logs for any evidence of prior exploitation attempts

Patch Information

As of the last modification date (2026-03-03), no official patch has been released by the Step-Video-T2V maintainers. Users should monitor the GitHub Issue #65 for updates and patch availability. The recommended remediation is to replace pickle.loads() with a secure serialization format such as JSON.

Workarounds

• Implement network-level access controls to ensure only trusted hosts can reach the vulnerable API endpoints
• Deploy the application behind an authentication gateway to prevent unauthorized access to the API
• Modify the source code locally to replace pickle.loads() with json.loads() for handling request data
• Run the application in a sandboxed or containerized environment to limit the impact of potential exploitation

# Configuration example - Restrict access using iptables
# Block external access to the vulnerable API ports
iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP