CVE-2025-57622 PUBLISHED

An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component

• https://github.com/stepfun-ai/Step-Video-T2V/blob/main/api/call_remote_server.py
• https://github.com/stepfun-ai/Step-Video-T2V/issues/65

• n/a text