#SDK vulnerability

Bucket Squatting in Vertex AI SDK Opened Cross-Tenant RCE Window

A staging-bucket naming flaw in two versions of Google's Vertex AI Python SDK let attackers pre-register a victim's expected bucket and swap in a malicious pickle model before the platform could retrieve the original.