CVE-2025-57622

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-03 · updated 2026-06-17
Weakness: CWE-502

Description

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component

References

https://github.com/stepfun-ai/Step-Video-T2V/blob/main/api/call_remote_server.py
https://github.com/stepfun-ai/Step-Video-T2V/issues/65

Get alerted when CVE-2025-57622 or the next vulnerability affects your stack