Adversarial Robustness Toolbox (Kubeflow component, robustness_evaluation_fgsm_pytorch.py): The ART Kubeflow evaluation

Impact

The ART Kubeflow evaluation script passes the --clip_values and --input_shape arguments through eval(), so whoever controls those strings executes arbitrary Python inside the pipeline pod. On a GPU cluster that pod usually holds the pipeline service account and mounted dataset volumes, which is the payoff. This is the third of a family whose two siblings, CVE-2026-31228 and CVE-2026-31229, are already in the database.

Who can reach it

Anyone who can influence the pipeline configuration or the automated scripts that invoke the ART robustness evaluation step - so a tenant with pipeline-authoring rights, or an upstream component that builds the argument list from user-supplied data.

What to do

Upgrade the adversarial-robustness-toolbox package past 1.20.1 wherever the Kubeflow ART component is deployed. Note this is a pip package pulled into pipeline images, so patching Kubeflow itself does not fix it - you have to rebuild the component images.

References