OmniGen2-RL contains a deserialization of untrusted data vulnerability (CWE-502) in its reward server component. This flaw allows remote attackers to send malicious HTTP POST requests containing crafted pickle data, which is insecurely deserialized by the server. Because the deserialization is unauthenticated and directly processes attacker-controlled input, it enables arbitrary code execution on the host system. The vulnerability is identified as CVE-2026-25873 with a CVSS 4.0 base score of 9.3, indicating critical severity. The affected version is 0. No patch or remediation details have been disclosed.

Successful exploitation results in unauthenticated remote code execution on the host running the OmniGen2-RL reward server component. This can lead to full system compromise, allowing attackers to execute arbitrary commands with the privileges of the affected service. The vulnerability is critical due to the lack of authentication and the high impact of arbitrary code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the reward server component to trusted sources only and monitor for suspicious HTTP POST requests. Avoid exposing the vulnerable service to untrusted networks. Follow the vendor's updates closely for any released patches or official mitigations.