Boltz Insecure Deserialization Vulnerability Leading to Arbitrary Code Execution

A vulnerability allowing insecure deserialization has been identified in Boltz version 2.0.0, specifically within its molecule loading feature. The application utilizes Python's pickle module to deserialize molecule data files without proper validation. This flaw enables an attacker to execute arbitrary code by placing a malicious pickle file in a directory that Boltz processes, as the application will execute the code contained in the file upon loading it.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the system where Boltz is running.