CVE-2025-70560: 
Python vulnerability analysis and mitigation

CVE-2025-70560 is an insecure deserialization vulnerability in Boltz 2.0.0, a biomolecular structure prediction tool, affecting its molecule loading functionality. The application uses Python's pickle module to deserialize molecule data files (.pkl) without any validation, enabling arbitrary code execution when a malicious pickle file is processed. All versions up to and including 2.0.0 are affected; no patched version has been released as of the time of disclosure. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The vulnerable code resides in src/boltz/data/mol.py at line 80, where the load_molecules(), load_all_molecules(), and get_symmetries() functions call pickle.load() and pickle.loads() directly on file contents without any integrity checks or allowlist-based deserialization controls (GitHub Source). The attack vector is local (AV:L): an attacker must be able to place a crafted .pkl file into a directory that Boltz processes for molecule data. Because Python's pickle format supports arbitrary object reconstruction, a malicious payload embedded in a .pkl file will execute attacker-controlled code at deserialization time, with no user interaction required (GitHub Advisory).

Successful exploitation results in arbitrary code execution in the context of the user or service running Boltz, with high impact to confidentiality, integrity, and availability. An attacker could read sensitive data, modify or delete files, install persistent backdoors, or use the compromised host as a pivot point for lateral movement within the network. Research and computational biology environments running Boltz on shared infrastructure or processing externally supplied molecule data files are at elevated risk (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation reported at this time (Red Hat CVE). The EPSS score is approximately 0.02% (0.000200), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local file placement capability, which limits the attack surface compared to fully remote vulnerabilities, but shared or multi-tenant environments processing user-supplied data files remain at meaningful risk (GitHub Advisory).

1. Reconnaissance: Identify a target system running Boltz 2.0.0 (pip package boltz <= 2.0.0) that processes molecule data from a directory accessible to the attacker.
2. Craft malicious pickle payload: Use Python to generate a malicious .pkl file that executes arbitrary commands upon deserialization. Example:

import pickle, os
class Exploit(object):
    def __reduce__(self):
        return (os.system, ('id > /tmp/pwned',))
with open('MALICIOUS.pkl', 'wb') as f:
    pickle.dump(Exploit(), f)

3. Place the payload: Copy the crafted MALICIOUS.pkl file into the molecule data directory that Boltz is configured to process (e.g., the CCD components directory or any directory passed to load_molecules() or load_all_molecules()).
4. Trigger deserialization: Wait for or trigger Boltz to process the directory — for example, by initiating a structure prediction job that causes load_molecules() or load_all_molecules() to glob and load all .pkl files in the target directory.
5. Achieve code execution: The pickle.load() call at mol.py:80 deserializes the malicious object, executing the attacker's payload in the context of the Boltz process (GitHub Source, GitHub Advisory).

• File System: Unexpected or newly created .pkl files in Boltz molecule data directories, especially files not matching known CCD component names; unusual scripts or binaries written to /tmp/ or the Boltz working directory.
• Process: Unexpected child processes spawned by the Python process running Boltz (e.g., bash, sh, curl, wget, python) — particularly processes with network connections or file write activity.
• Logs: Python tracebacks or unusual output in Boltz application logs during molecule loading; OS-level audit logs (e.g., auditd) showing execve calls originating from the Boltz Python process.
• Network: Outbound connections from the Boltz host to unexpected external IP addresses or domains, potentially indicating reverse shell or data exfiltration activity following exploitation.

No official patch has been released for Boltz as of the disclosure date (GitHub Advisory). Recommended mitigations include: (1) restricting write access to molecule data directories so only trusted processes and users can place files; (2) avoiding running Boltz with elevated privileges; (3) validating the integrity of .pkl files using cryptographic signatures or checksums before loading; (4) replacing pickle with a safer serialization format (e.g., JSON, MessagePack, or safetensors) for molecule data; and (5) running Boltz in a sandboxed or containerized environment with limited network and filesystem access (Red Hat CVE).

The vulnerability was initially reported by security researcher Suman Roy via a GitHub issue requesting responsible disclosure contact information, which was closed as "not planned" by the maintainers (GitHub Issue). The advisory was subsequently published to the GitHub Advisory Database and picked up by automated vulnerability tracking services including Qualys, VulnDB, and Red Hat's CVE tracker. No significant public commentary from the broader security research community or major media coverage has been identified beyond standard CVE aggregation.