CVE-2025-57622

critical · 9.8

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component

9.8

CVSS

0.5%

EPSS (exploit prob.)

42nd

EPSS percentile

2026-03-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

References

https://github.com/stepfun-ai/Step-Video-T2V/blob/main/api/call_remote_server.py
https://github.com/stepfun-ai/Step-Video-T2V/issues/65

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-57622