Common Weakness Enumeration
CWE-502
Weakness AllowedDeserialization of Untrusted Data
Abstraction: Base · Status: Draft
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Notes
Maintenance
The relationships between CWE-502 and CWE-915 need further exploration. CWE-915 is more narrowly scoped to object modification, and is not necessarily used for deserialization.
Content history
Submission: CLASP
· 2006-07-19
· CWE Draft 3
Contribution: Abhi Balakrishnan
· 2024-02-29
· CWE 4.16
Contributed usability diagram concepts used by the CWE team
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Common_Consequences, Description, Relationships, Other_Notes, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2009-10-29
· CWE 1.6
updated Description, Other_Notes, Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2012-10-30
· CWE 2.3
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2013-02-21
· CWE 2.4
updated Alternate_Terms, Applicable_Platforms, Background_Details, Common_Consequences, Maintenance_Notes, Observed_Examples, Potential_Mitigations, References, Relationships
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2015-12-07
· CWE 2.9
updated Observed_Examples, References, Relationships
Modification: CWE Content Team
· MITRE
· 2017-05-03
· CWE 2.11
updated Applicable_Platforms, Demonstrative_Examples, Description, Potential_Mitigations, References
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Modes_of_Introduction, Potential_Mitigations, References, Relationships
Modification: CWE Content Team
· MITRE
· 2018-03-27
· CWE 3.1
updated Relationships
Modification: CWE Content Team
· MITRE
· 2019-01-03
· CWE 3.2
updated Related_Attack_Patterns, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Type
Modification: CWE Content Team
· MITRE
· 2019-09-19
· CWE 3.4
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Observed_Examples, References, Relationships
Modification: CWE Content Team
· MITRE
· 2020-06-25
· CWE 4.1
updated Alternate_Terms, Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2020-08-20
· CWE 4.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-12-10
· CWE 4.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-07-20
· CWE 4.5
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-06-28
· CWE 4.8
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated Applicable_Platforms
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Detection_Factors, References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes, Relationships
Modification: CWE Content Team
· MITRE
· 2024-11-19
· CWE 4.16
updated Common_Consequences, Description, Diagram, Potential_Mitigations, Relationships
Modification: CWE Content Team
· MITRE
· 2025-09-09
· CWE 4.18
updated Observed_Examples, Potential_Mitigations, References
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Applicable_Platforms, Observed_Examples, Relationships, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-04-30
· CWE 4.20
updated Alternate_Terms, Relationships
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings
6050 vulnerabilities reference this CWE, most recent first.
CVE-2026-124318 (GCVE-0-2026-124318)
Vulnerability from cvelistv5 – Published: 2026-11-07 14:17 – Updated: 2026-11-07 14:17 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields
Summary
Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.
Severity
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/treeio/treeio/issues/165 | issue-tracking |
| https://github.com/treeio/treeio/blob/bae3115f401… | technical-description |
| https://github.com/treeio/treeio/blob/bae3115f401… | technical-description |
| https://github.com/treeio/treeio | product |
| https://www.vulncheck.com/advisories/treeio-throu… | third-party-advisory |
Date Public
2026-11-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/treeio/treeio",
"product": "treeio",
"repo": "https://github.com/treeio/treeio",
"vendor": "treeio",
"versions": [
{
"lessThanOrEqual": "2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MJ DHURGESH"
}
],
"datePublic": "2026-11-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T14:17:57.859Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/treeio/treeio/issues/165"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1101-L1109"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1265-L1273"
},
{
"tags": [
"product"
],
"url": "https://github.com/treeio/treeio"
},
{
"name": "VulnCheck Advisory: Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124318",
"datePublished": "2026-11-07T14:17:57.859Z",
"dateReserved": "2026-11-07T12:27:51.208Z",
"dateUpdated": "2026-11-07T14:17:57.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120859 (GCVE-0-2026-120859)
Vulnerability from cvelistv5 – Published: 2026-11-05 17:14 – Updated: 2026-11-05 17:14
VLAI
EPSS
VEX
Title
PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files
Summary
PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.
Severity
CWE
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://github.com/PyMoDAQ/PyMoDAQ/security/advis… | vendor-advisory |
| https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff7… | patch |
| https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042… | patch |
| https://github.com/PyMoDAQ/PyMoDAQ/commit/ae00425… | patch |
| https://github.com/PyMoDAQ/PyMoDAQ/commit/041e8a2… | patch |
| https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.3.10 | release-notes |
| https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.2.14 | release-notes |
| https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.1.15 | release-notes |
| https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/4.4.13 | release-notes |
| https://github.com/PyMoDAQ/PyMoDAQ/blob/5.3.9/pac… | technical-description |
| https://www.vulncheck.com/advisories/pymodaq-befo… | third-party-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| PyMoDAQ | PyMoDAQ |
Affected:
0 , < 4.4.13
(semver)
|
|
| PyMoDAQ | pymodaq_data |
Affected:
0 , < 5.1.15
(semver)
Affected: 5.2.0 , < 5.2.14 (semver) Affected: 5.3.0 , < 5.3.10 (semver) |
|
| PyMoDAQ | pymodaq_gui |
Affected:
0 , < 5.1.15
(semver)
Affected: 5.2.0 , < 5.2.14 (semver) Affected: 5.3.0 , < 5.3.10 (semver) |
|
| PyMoDAQ | pymodaq_utils |
Affected:
0 , < 5.1.15
(semver)
Affected: 5.2.0 , < 5.2.14 (semver) Affected: 5.3.0 , < 5.3.10 (semver) |
Date Public
2026-11-04 14:53
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymodaq",
"product": "PyMoDAQ",
"repo": "https://github.com/PyMoDAQ/PyMoDAQ",
"vendor": "PyMoDAQ",
"versions": [
{
"lessThan": "4.4.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymodaq-data",
"product": "pymodaq_data",
"repo": "https://github.com/PyMoDAQ/PyMoDAQ",
"vendor": "PyMoDAQ",
"versions": [
{
"lessThan": "5.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.2.14",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThan": "5.3.10",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymodaq-gui",
"product": "pymodaq_gui",
"repo": "https://github.com/PyMoDAQ/PyMoDAQ",
"vendor": "PyMoDAQ",
"versions": [
{
"lessThan": "5.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.2.14",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThan": "5.3.10",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymodaq-utils",
"product": "pymodaq_utils",
"repo": "https://github.com/PyMoDAQ/PyMoDAQ",
"vendor": "PyMoDAQ",
"versions": [
{
"lessThan": "5.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.2.14",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThan": "5.3.10",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dilanka Kaushal Hewage (r3vpwnx)"
}
],
"datePublic": "2026-11-04T14:53:53.000Z",
"descriptions": [
{
"lang": "en",
"value": "PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:14:58.101Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jw9g-5c9x-cf84)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff74d82624c640bd79513f5b4675ea6d88da"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042a58f5d4870a2b45fe2c9423aafe6b9203"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/commit/ae0042513eb979c84da690825902658c625718d1"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/commit/041e8a22b3dbe3c986ec0ea3c6b46a22f5efe374"
},
{
"name": "PyMoDAQ 5.3.10 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.3.10"
},
{
"name": "PyMoDAQ 5.2.14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.2.14"
},
{
"name": "PyMoDAQ 5.1.15 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.1.15"
},
{
"name": "PyMoDAQ 4.4.13 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/4.4.13"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/blob/5.3.9/packages/pymodaq_data/src/pymodaq_data/h5modules/backends.py#L477-L478"
},
{
"name": "VulnCheck Advisory: PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pymodaq-before-5.3.10-arbitrary-code-execution-via-crafted-hdf5-dock-layout-and-xml-settings-files"
}
],
"title": "PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120859",
"datePublished": "2026-11-05T17:14:58.101Z",
"dateReserved": "2026-11-03T00:37:48.051Z",
"dateUpdated": "2026-11-05T17:14:58.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120833 (GCVE-0-2026-120833)
Vulnerability from cvelistv5 – Published: 2026-11-03 00:13 – Updated: 2026-11-03 00:13
VLAI
EPSS
VEX
Title
labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch
Summary
labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.
Severity
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/usnistgov/labbench/pull/32 | patchissue-tracking |
| https://github.com/usnistgov/labbench/commit/ac9b… | patch |
| https://github.com/usnistgov/labbench/blob/0.46.0… | technical-description |
| https://github.com/usnistgov/labbench/blob/0.46.1… | release-notes |
| https://pypi.org/project/labbench/0.46.1/ | product |
| https://github.com/usnistgov/labbench | product |
| https://www.vulncheck.com/advisories/labbench-bef… | third-party-advisory |
Date Public
2026-11-02 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/labbench",
"product": "labbench",
"repo": "https://github.com/usnistgov/labbench",
"vendor": "NIST",
"versions": [
{
"lessThan": "0.46.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dilanka Kaushal Hewage (r3vpwnx)"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T00:13:42.998Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Pull Request #32",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/usnistgov/labbench/pull/32"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666"
},
{
"name": "labbench ChangeLog",
"tags": [
"release-notes"
],
"url": "https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md"
},
{
"tags": [
"product"
],
"url": "https://pypi.org/project/labbench/0.46.1/"
},
{
"tags": [
"product"
],
"url": "https://github.com/usnistgov/labbench"
},
{
"name": "VulnCheck Advisory: labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch"
}
],
"title": "labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120833",
"datePublished": "2026-11-03T00:13:42.998Z",
"dateReserved": "2026-11-03T00:06:11.273Z",
"dateUpdated": "2026-11-03T00:13:42.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120499 (GCVE-0-2026-120499)
Vulnerability from cvelistv5 – Published: 2026-11-05 16:55 – Updated: 2026-11-05 18:30
VLAI
EPSS
VEX
Title
h5io before 0.2.6 Arbitrary Code Execution via read_hdf5
Summary
h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 18:30 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/h5io/h5io/security/advisories/… | vendor-advisory |
| https://github.com/h5io/h5io/commit/afff1d61b3179… | patch |
| https://github.com/h5io/h5io/releases/tag/h5io-0.2.6 | release-notes |
| https://github.com/h5io/h5io/blob/h5io-0.2.5/h5io… | technical-description |
| https://www.vulncheck.com/advisories/h5io-before-… | third-party-advisory |
Date Public
2026-11-05 16:19
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120499",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T18:30:02.460697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:30:58.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/h5io",
"product": "h5io",
"repo": "https://github.com/h5io/h5io",
"vendor": "h5io",
"versions": [
{
"lessThan": "0.2.6",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dilanka Kaushal Hewage (r3vpwnx)"
}
],
"datePublic": "2026-11-05T16:19:44.000Z",
"descriptions": [
{
"lang": "en",
"value": "h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:55:32.599Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vwvw-f6v4-w737)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737"
},
{
"tags": [
"patch"
],
"url": "https://github.com/h5io/h5io/commit/afff1d61b31790f8c27e6c577bb7703eb1883ddd"
},
{
"name": "h5io h5io-0.2.6 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/h5io/h5io/releases/tag/h5io-0.2.6"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/h5io/h5io/blob/h5io-0.2.5/h5io/_h5io.py#L601-L604"
},
{
"name": "VulnCheck Advisory: h5io before 0.2.6 Arbitrary Code Execution via read_hdf5",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/h5io-before-0.2.6-arbitrary-code-execution-via-read-hdf5"
}
],
"title": "h5io before 0.2.6 Arbitrary Code Execution via read_hdf5",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120499",
"datePublished": "2026-11-05T16:55:32.599Z",
"dateReserved": "2026-11-02T15:06:46.389Z",
"dateUpdated": "2026-11-05T18:30:58.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120320 (GCVE-0-2026-120320)
Vulnerability from cvelistv5 – Published: 2026-11-02 01:30 – Updated: 2026-11-06 19:16 X_Open Source
VLAI
EPSS
VEX
Title
jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization
Summary
A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:16 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429653 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429653/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120320 | third-party-advisory |
| https://vuldb.com/submit/1015025 | third-party-advisory |
| https://github.com/0xGenesi/CVE/blob/main/MoviePi… | exploit |
| https://github.com/jxxghp/MoviePilot/pull/6930 | issue-trackingpatch |
| https://github.com/jxxghp/MoviePilot/commit/6034d… | patch |
| https://github.com/jxxghp/MoviePilot/releases/tag… | patch |
| https://github.com/jxxghp/MoviePilot/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jxxghp | MoviePilot |
Affected:
3.1.0
Affected: 3.1.1 Affected: 3.1.2 Unaffected: 3.1.3 cpe:2.3:a:jxxghp:moviepilot:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120320",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:16:13.414678Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:16:41.393Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:jxxghp:moviepilot:*:*:*:*:*:*:*:*"
],
"modules": [
"Workflow Fork Endpoint"
],
"product": "MoviePilot",
"vendor": "jxxghp",
"versions": [
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.1"
},
{
"status": "affected",
"version": "3.1.2"
},
{
"status": "unaffected",
"version": "3.1.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "chenhuanlin (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T01:30:30.012Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429653 | jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429653"
},
{
"name": "VDB-429653 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429653/cti"
},
{
"name": "CVE-2026-120320 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120320"
},
{
"name": "Submit #1015025 | jxxghp MoviePilot v3 branch (latest) code execution (deserialization)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015025"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xGenesi/CVE/blob/main/MoviePilot_Workflow_Fork_Pickle_Deserialization_RCE.md"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/jxxghp/MoviePilot/pull/6930"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jxxghp/MoviePilot/commit/6034dcc880c13079aeb398dbe32c346ebcd3a6d2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jxxghp/MoviePilot/releases/tag/v3.1.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/jxxghp/MoviePilot/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-01T14:15:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120320",
"datePublished": "2026-11-02T01:30:30.012Z",
"dateReserved": "2026-11-01T13:10:06.833Z",
"dateUpdated": "2026-11-06T19:16:41.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119706 (GCVE-0-2026-119706)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-11-02 18:29
VLAI
EPSS
VEX
Title
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
Summary
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:39 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/InternLM/lmdeploy/issues/4698 | issue-tracking |
| https://github.com/InternLM/lmdeploy | product |
| https://github.com/InternLM/lmdeploy/blob/v0.18.0… | technical-description |
| https://github.com/InternLM/lmdeploy/blob/v0.18.0… | technical-description |
| https://github.com/InternLM/lmdeploy/pull/4964 | patchissue-tracking |
| https://www.vulncheck.com/advisories/lmdeploy-0.9… | third-party-advisory |
Impacted products
Date Public
2026-06-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119706",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:39:38.070682Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:39:58.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/InternLM/lmdeploy/issues/4698"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/lmdeploy",
"product": "lmdeploy",
"vendor": "InternLM",
"versions": [
{
"lessThanOrEqual": "0.18.0",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.18.0",
"versionStartIncluding": "0.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "starsalt0124"
},
{
"lang": "en",
"type": "reporter",
"value": "Mo Safari"
}
],
"datePublic": "2026-06-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:29:40.134Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #4698",
"tags": [
"issue-tracking"
],
"url": "https://github.com/InternLM/lmdeploy/issues/4698"
},
{
"tags": [
"product"
],
"url": "https://github.com/InternLM/lmdeploy"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoints/management.py#L55-L60"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.py#L345"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/InternLM/lmdeploy/pull/4964"
},
{
"name": "VulnCheck Advisory: LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization"
}
],
"title": "LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119706",
"datePublished": "2026-10-30T15:16:07.266Z",
"dateReserved": "2026-10-30T14:49:23.368Z",
"dateUpdated": "2026-11-02T18:29:40.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119526 (GCVE-0-2026-119526)
Vulnerability from cvelistv5 – Published: 2026-10-30 18:30 – Updated: 2026-10-30 19:00
VLAI
EPSS
VEX
Title
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
Summary
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.
This issue affects Royal Event: from n/a through 2.0.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:46 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/theme/r… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ThemeREX | Royal Event |
Affected:
n/a , ≤ 2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119526",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T18:46:45.081042Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:00:20.359Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Royal Event",
"vendor": "ThemeREX",
"versions": [
{
"lessThanOrEqual": "2.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Bonds | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.\u003cp\u003eThis issue affects Royal Event: from n/a through 2.0.\u003c/p\u003e"
}
],
"value": "Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.\n\nThis issue affects Royal Event: from n/a through 2.0."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:32:14.692Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/theme/royal-event/vulnerability/wordpress-royal-event-theme-2-0-php-object-injection-vulnerability?_s_id=cve"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Royal Event theme \u003c= 2.0 - PHP Object Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-119526",
"datePublished": "2026-10-30T18:30:31.153Z",
"dateReserved": "2026-10-30T09:20:18.659Z",
"dateUpdated": "2026-10-30T19:00:20.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119516 (GCVE-0-2026-119516)
Vulnerability from cvelistv5 – Published: 2026-11-06 08:00 – Updated: 2026-11-07 18:36 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability
Summary
Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 18:14 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mamunur Rashid | Radius Booking — Booking Calendar for Appointments & Services |
Affected:
0 , ≤ 1.0.20
(custom)
|
Date Public
2026-11-04 07:31
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119516",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T18:14:09.706686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T18:36:44.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "radius-booking",
"product": "Radius Booking \u2014 Booking Calendar for Appointments \u0026amp; Services",
"vendor": "Mamunur Rashid",
"versions": [
{
"changes": [
{
"at": "1.0.21",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.0.20",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hhhai | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-04T07:31:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking \u2014 Booking Calendar for Appointments \u0026amp; Services radius-booking allows Object Injection.\u003cp\u003eThis issue affects Radius Booking \u2014 Booking Calendar for Appointments \u0026amp; Services: from n/a through 1.0.20.\u003c/p\u003e"
}
],
"value": "Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking \u2014 Booking Calendar for Appointments \u0026amp; Services radius-booking allows Object Injection.This issue affects Radius Booking \u2014 Booking Calendar for Appointments \u0026amp; Services: from n/a through 1.0.20."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T08:00:31.536Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/radius-booking/vulnerability/wordpress-radius-booking-booking-calendar-for-appointments-services-plugin-1-0-20-php-object-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Radius Booking \u2014 Booking Calendar for Appointments \u0026amp; Services plugin to the latest available version (at least 1.0.21)."
}
],
"value": "Update the WordPress Radius Booking \u2014 Booking Calendar for Appointments \u0026amp; Services plugin to the latest available version (at least 1.0.21)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Radius Booking \u2014 Booking Calendar for Appointments \u0026 Services plugin \u003c= 1.0.20 - PHP Object Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-119516",
"datePublished": "2026-11-06T08:00:31.536Z",
"dateReserved": "2026-10-30T09:20:18.657Z",
"dateUpdated": "2026-11-07T18:36:44.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119120 (GCVE-0-2026-119120)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:58 – Updated: 2026-11-03 15:39
VLAI
EPSS
VEX
Title
Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
Summary
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 15:36 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/unclecode/crawl4ai/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/crawl4ai-0.9… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119120",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T15:36:37.870750Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:39:40.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f856-7xp9-w3cc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/crawl4ai",
"product": "crawl4ai",
"vendor": "unclecode",
"versions": [
{
"lessThan": "0.9.5",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.9.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
},
{
"lang": "en",
"type": "remediation developer",
"value": "ntohidi"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:58:04.414Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-f856-7xp9-w3cc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f856-7xp9-w3cc"
},
{
"name": "VulnCheck Advisory: Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-untrusted-model-loading-via-cosinestrategy-model-name"
}
],
"title": "Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119120",
"datePublished": "2026-10-29T15:58:04.414Z",
"dateReserved": "2026-10-29T14:25:14.745Z",
"dateUpdated": "2026-11-03T15:39:40.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118938 (GCVE-0-2026-118938)
Vulnerability from cvelistv5 – Published: 2026-10-30 21:19 – Updated: 2026-11-06 16:00
VLAI
EPSS
VEX
Title
Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
Summary
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component of the name in its import tracking and renders the operation as a plain import (for instance, 'python -m fickling' displays it as 'from optparse import Values.read_file'), so the trailing attribute reference is never analyzed as a call. The OvertlyBadEvals analysis pass does not flag it, and check_safety() returns LIKELY_SAFE with zero findings. This allows an attacker to reach a class method that performs code execution: optparse.Values.read_file executes exec(open(filename).read(), vars), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate. optparse is present in all current CPython 3.x releases (deprecated as of Python 3.13, not removed). This weakness is in the resolution and analysis of dotted attribute-path names, and is distinct from and independently fixable from the module-origin trust weakness tracked as CVE-2026-16760: resolving or flagging dotted attribute-path imports closes this vector while leaving the module-level trust behavior unchanged. This bypass was verified to remain present on the vendor master branch at commit d011709 as of 2026-10-30, after the vendor's October blocklist additions and a new heuristic that flags private stdlib attributes; because the public class method Values.read_file is neither blocklisted nor flagged as a private attribute, it is not addressed by those remediations.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 15:59 UTC
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| trailofbits | fickling |
Affected:
0 , ≤ 0.1.12
(custom)
|
Date Public
2026-10-30 21:17
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:59:52.672368Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:00:14.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org/project/fickling/",
"defaultStatus": "affected",
"packageName": "fickling",
"product": "fickling",
"repo": "https://github.com/trailofbits/fickling",
"vendor": "trailofbits",
"versions": [
{
"lessThanOrEqual": "0.1.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Christopher Aziz (Bombadil Systems LLC)"
}
],
"datePublic": "2026-10-30T21:17:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example \"Values.read_file\") is resolved by pickle\u0027s find_class through _getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component of the name in its import tracking and renders the operation as a plain import (for instance, \u0027python -m fickling\u0027 displays it as \u0027from optparse import Values.read_file\u0027), so the trailing attribute reference is never analyzed as a call. The OvertlyBadEvals analysis pass does not flag it, and check_safety() returns LIKELY_SAFE with zero findings. This allows an attacker to reach a class method that performs code execution: optparse.Values.read_file executes exec(open(filename).read(), vars), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate. optparse is present in all current CPython 3.x releases (deprecated as of Python 3.13, not removed). This weakness is in the resolution and analysis of dotted attribute-path names, and is distinct from and independently fixable from the module-origin trust weakness tracked as CVE-2026-16760: resolving or flagging dotted attribute-path imports closes this vector while leaving the module-level trust behavior unchanged. This bypass was verified to remain present on the vendor master branch at commit d011709 as of 2026-10-30, after the vendor\u0027s October blocklist additions and a new heuristic that flags private stdlib attributes; because the public class method Values.read_file is neither blocklisted nor flagged as a private attribute, it is not addressed by those remediations.\u003c/p\u003e"
}
],
"value": "In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example \"Values.read_file\") is resolved by pickle\u0027s find_class through _getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component of the name in its import tracking and renders the operation as a plain import (for instance, \u0027python -m fickling\u0027 displays it as \u0027from optparse import Values.read_file\u0027), so the trailing attribute reference is never analyzed as a call. The OvertlyBadEvals analysis pass does not flag it, and check_safety() returns LIKELY_SAFE with zero findings. This allows an attacker to reach a class method that performs code execution: optparse.Values.read_file executes exec(open(filename).read(), vars), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate. optparse is present in all current CPython 3.x releases (deprecated as of Python 3.13, not removed). This weakness is in the resolution and analysis of dotted attribute-path names, and is distinct from and independently fixable from the module-origin trust weakness tracked as CVE-2026-16760: resolving or flagging dotted attribute-path imports closes this vector while leaving the module-level trust behavior unchanged. This bypass was verified to remain present on the vendor master branch at commit d011709 as of 2026-10-30, after the vendor\u0027s October blocklist additions and a new heuristic that flags private stdlib attributes; because the public class method Values.read_file is neither blocklisted nor flagged as a private attribute, it is not addressed by those remediations."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can craft a malicious pickle whose STACK_GLOBAL operand encodes a dotted attribute path to a code-executing class method, such as optparse.Values.read_file. Fickling treats the dotted name as a single trusted import and does not analyze the resulting call, so check_safety() returns LIKELY_SAFE and fickling.load() deserializes the payload, executing attacker-controlled Python with the privileges of the victim process. The vector is independent of the specific contents of UNSAFE_IMPORTS; it stems from fickling resolving and recording dotted attribute-path names incorrectly, so denylisting individual modules does not address it."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706 Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T21:19:13.015Z",
"orgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
"shortName": "BombadilSystems"
},
"references": [
{
"name": "Bombadil Systems advisory listing",
"url": "https://bombadil.systems/advisories.html"
},
{
"name": "fickling 0.1.12 on PyPI",
"url": "https://pypi.org/project/fickling/0.1.12/"
},
{
"name": "fickling source repository",
"url": "https://github.com/trailofbits/fickling"
},
{
"name": "Vendor remediation merge commit d011709 (does not address this vector; optparse.Values.read_file remains exploitable on master)",
"url": "https://github.com/trailofbits/fickling/commit/d011709"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "aa17e1a1-c329-4d6e-a1ed-8d0188aea082",
"assignerShortName": "BombadilSystems",
"cveId": "CVE-2026-118938",
"datePublished": "2026-10-30T21:19:13.015Z",
"dateReserved": "2026-10-29T05:42:00.023Z",
"dateUpdated": "2026-11-06T16:00:14.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Mitigation
Implementation
Explicitly define a final object() to prevent deserialization.
Mitigation
Architecture and Design
Implementation
- Make fields transient to protect them from deserialization.
- An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Mitigation
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
Mitigation
Architecture and Design
Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
Mitigation MIT-29
Operation
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-586: Object Injection
An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution.