ZenML version 0.94.6 contains a remote code execution vulnerability in its CloudpickleMaterializer component. This flaw allows attackers with write access to a shared artifact store to execute arbitrary code by replacing a stored artifact.pkl file with a malicious cloudpickle payload. The vulnerability arises from the unsanitized use of cloudpickle.load(), which executes the malicious __reduce__ method embedded in the payload during artifact materialization.