Threats affecting pkg:pypi/mosaicml/composer

CVE-2026-109153 is a path traversal vulnerability in MosaicML Composer versions 0.32.0 and 0.32.1. It affects the tarball.extractall function in the checkpoint extraction component, allowing remote attackers to manipulate file paths during extraction. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. No patch or official fix information is provided in the available data.

CVE-2026-10043 is a high-severity vulnerability in MosaicML Composer version 0.32.1 involving deserialization of untrusted data. The flaw occurs during the parsing of checkpoints, where insufficient validation allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. This vulnerability can lead to full compromise of the affected process.