Step-Video-T2V Remote Code Execution Vulnerability via Insecure Pickle Deserialization

A remote code execution vulnerability has been identified in the Step-Video-T2V application. This issue arises from the unsafe deserialization of untrusted data using Python's pickle module, specifically in the /vae-api and /caption-api endpoints. The vulnerability allows remote attackers to execute arbitrary code on the server, potentially leading to a full system compromise.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, with potential for full system compromise.

Reproduction

To reproduce this vulnerability, send a request to the /vae-api or /caption-api endpoint with a payload that includes a serialized object using Python's pickle format. The server will deserialize the object without any validation, allowing for the execution of arbitrary code.