High severityOSV Advisory· Published Feb 3, 2026· Updated Feb 19, 2026
CVE-2025-70560
CVE-2025-70560
Description
Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
boltzPyPI | <= 2.0.0 | — |
Affected products
2Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.