Summary
ESPectre analysis tools load NPZ datasets with NumPy pickle support enabled, allowing object arrays in a dataset to trigger unsafe deserialization. If a maintainer or developer runs an affected tool on a maliciously contributed dataset, code may execute with that user's privileges.
ESPectre analysis tools load NPZ datasets with NumPy pickle support enabled, allowing object arrays in a dataset to trigger unsafe deserialization. If a maintainer or developer runs an affected tool on a maliciously contributed dataset, code may execute with that user's privileges.
Affected context
Before version 3.0.0-rc1, ESPectre's Micro-ESPectre analysis tools load NPZ datasets with pickle support enabled, either through shared CSI utilities or a direct loader. The affected tools include tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py. Risk arises when a tool processes a dataset containing an object-typed array, such as one supplied under micro-espectre/data.
Before version 3.0.0-rc1, ESPectre's Micro-ESPectre analysis tools load NPZ datasets with pickle support enabled, either through shared CSI utilities or a direct loader. The affected tools include tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py. Risk arises when a tool processes a dataset containing an object-typed array, such as one supplied under micro-espectre/data.
Exploit preconditions
- Attack surface: NPZ datasets processed by the Micro-ESPectre analysis tools
- Required access: Ability to contribute or modify a dataset, for example through a pull request
- Trigger point: A maintainer or developer runs an affected tool that loads or accesses the contributed dataset field
- Why exploitation is possible: Pickle-enabled loading can deserialize attacker-controlled objects during dataset processing
- Attack surface: NPZ datasets processed by the Micro-ESPectre analysis tools
- Required access: Ability to contribute or modify a dataset, for example through a pull request
- Trigger point: A maintainer or developer runs an affected tool that loads or accesses the contributed dataset field
- Why exploitation is possible: Pickle-enabled loading can deserialize attacker-controlled objects during dataset processing
Why this happens
The tools use NumPy loading paths with pickle support enabled for NPZ datasets. When an object-typed array is deserialized, the loader may process attacker-controlled pickle data rather than treating the dataset as inert input. This is CWE-502: Deserialization of Untrusted Data—untrusted serialized content is allowed to influence object construction and execute code.
The tools use NumPy loading paths with pickle support enabled for NPZ datasets. When an object-typed array is deserialized, the loader may process attacker-controlled pickle data rather than treating the dataset as inert input. This is CWE-502: Deserialization of Untrusted Data—untrusted serialized content is allowed to influence object construction and execute code.
Potential impact
- Arbitrary code could execute in the maintainer's or developer's process
- Local files or credentials accessible to that account may be exposed or modified
- Development environments or related systems could be compromised
- Malicious changes could be introduced into project data or workflows
- Arbitrary code could execute in the maintainer's or developer's process
- Local files or credentials accessible to that account may be exposed or modified
- Development environments or related systems could be compromised
- Malicious changes could be introduced into project data or workflows
General mitigation guidance
Defensive approaches focus on treating contributed datasets as untrusted and avoiding executable serialization formats.
- Disable pickle support when loading datasets that do not require it
- Prefer non-executable data formats and validate inputs against a strict schema
- Separate dataset validation from analysis and run processing in a restricted environment
- Limit the privileges and accessible secrets of accounts and processes that handle contributed data
- Apply review and access controls to changes that add or modify datasets
Defensive approaches focus on treating contributed datasets as untrusted and avoiding executable serialization formats.
- Disable pickle support when loading datasets that do not require it
- Prefer non-executable data formats and validate inputs against a strict schema
- Separate dataset validation from analysis and run processing in a restricted environment
- Limit the privileges and accessible secrets of accounts and processes that handle contributed data
- Apply review and access controls to changes that add or modify datasets
How teams detect issues like this
- Use static analysis to identify NumPy loading calls that enable pickle support, including indirect calls through shared utilities
- Review data-processing paths for object-typed arrays and assumptions that repository datasets are trusted
- Add CI checks or repository policies that reject unsafe dataset formats and unexpected object arrays
- Use automated code review tools to flag unsafe deserialization patterns and verify that input validation occurs before processing
- Use static analysis to identify NumPy loading calls that enable pickle support, including indirect calls through shared utilities
- Review data-processing paths for object-typed arrays and assumptions that repository datasets are trusted
- Add CI checks or repository policies that reject unsafe dataset formats and unexpected object arrays
- Use automated code review tools to flag unsafe deserialization patterns and verify that input validation occurs before processing
