CVE-2026-25873
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component, allowing attackers to send malicious HTTP POST requests. The vulnerability stems from insecure pickle deserialization, enabling arbitrary command execution on the host system.
Risk Assessment
The risk for the organization includes full server compromise, data theft, or using the server as a pivot point for further attacks within the internal network.
Recommendation
Immediately update OmniGen2-RL to the latest patched version and enforce authentication for all reward server endpoints.
Original NVD description (English source)
OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code execution on the host system running the exposed service.