High severity8.4OSV Advisory· Published Feb 3, 2026· Updated Jun 17, 2026
CVE-2025-70560
CVE-2025-70560
Description
Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achieve arbitrary code execution when the file is loaded.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
boltzPyPI | <= 2.0.0 | — |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-fjm6-8xp2-4fwcnvdADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-70560ghsaADVISORY
- github.com/jwohlwend/boltz/blob/cb04aeccdd480fd4db707f0bbafde538397fa2ac/src/boltz/data/mol.pynvdProductWEB
- github.com/jwohlwend/boltz/issues/600nvdIssue TrackingWEB
News mentions
0No linked articles in our index yet.