关键漏洞信息 漏洞标题 Unsafe use of Pickle deserialization leads to RCE 严重性 CVSS v3 base metrics: 8.8 / 10 Attack vector: Network Attack complexity: Low Privileges required: None User interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High CVE ID CVE-2025-58757 弱点 CWE-502 影响 Arbitrary code execution 漏洞描述 Description: The function in automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using . This function lacks any security measures, leading to arbitrary code execution. 修复建议 Repair suggestions: Verify the data source and content before deserializing, or use a safe deserialization method, which should have a similar fix in huggingface's transformer library.