OmniGen2-RL vulnerabilities

1 known vulnerability in OmniGen2-RL from Beijing Academy of Artificial Intelligence (BAAI). 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  OmniGen2-RL: Deserialization of Untrusted Data

  CVE-2026-25873Mar 18, 2026Beijing Academy of Artificial Intelligence (BAAI)EPSS 1.25%

  OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization