CVE-2025-70560
📋 TL;DR
Boltz 2.0.0 contains a critical insecure deserialization vulnerability that allows arbitrary code execution when loading malicious pickle files. Attackers who can place crafted files in directories processed by boltz can achieve remote code execution. This affects all users of Boltz 2.0.0 who load molecule data files from untrusted sources.
💻 Affected Systems
- Boltz
📦 What is this software?
Boltz by Jwohlwend
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the boltz process, potentially leading to data theft, lateral movement, or persistence establishment.
Likely Case
Local privilege escalation or remote code execution if boltz processes files from network shares or user-uploaded directories.
If Mitigated
Limited impact if file access is restricted to trusted sources and boltz runs with minimal privileges.
🎯 Exploit Status
Exploitation requires file placement capability; Python pickle exploits are well-documented and easy to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/jwohlwend/boltz/issues/600
Restart Required: No
Instructions:
No official patch available. Monitor GitHub repository for updates and apply when released.
🔧 Temporary Workarounds
Disable pickle loading
allModify boltz source to replace pickle.load() with safe deserialization methods or disable molecule file loading functionality.
Edit src/boltz/data/mol.py line 80 to implement safe deserialization
Restrict file access
linuxLimit boltz to read-only access from trusted directories using filesystem permissions.
chmod 400 trusted_molecule_files/
chown root:root boltz_process
🧯 If You Can't Patch
- Run boltz with minimal privileges (non-root user with restricted capabilities)
- Implement strict input validation and only allow loading from whitelisted trusted file sources
🔍 How to Verify
Check if Vulnerable:
Check if using Boltz 2.0.0 and examine src/boltz/data/mol.py line 80 for pickle.load() usage without validation.Check Version:
python -c "import boltz; print(boltz.__version__)"Verify Fix Applied:
Verify pickle.load() has been replaced with safe deserialization or removed from the codebase.📡 Detection & Monitoring
Log Indicators:
- Unusual process spawns from boltz executable
- File access errors to pickle files in unexpected locations
Network Indicators:
- Unexpected outbound connections from boltz process
SIEM Query:
process_name:"python" AND parent_process_name:"boltz" AND cmdline:"pickle"