CVE-2026-120859
7.8 HIGHpublic exploit availablePublished 2026-11-05 · Updated 2026-11-05
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-95, CWE-502
Public exploit & PoC references
- https://github.com/PyMoDAQ/PyMoDAQ/blob/5.3.9/packages/pymodaq_data/src/pymodaq_data/h5modules/backends.py#L477-L478
- https://github.com/PyMoDAQ/PyMoDAQ/commit/041e8a22b3dbe3c986ec0ea3c6b46a22f5efe374
- https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042a58f5d4870a2b45fe2c9423aafe6b9203
- https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff74d82624c640bd79513f5b4675ea6d88da
- https://github.com/PyMoDAQ/PyMoDAQ/commit/ae0042513eb979c84da690825902658c625718d1
- https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/4.4.13
- https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.1.15
- https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.2.14
- https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.3.10
- https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84
All references
- https://github.com/PyMoDAQ/PyMoDAQ/blob/5.3.9/packages/pymodaq_data/src/pymodaq_data/h5modules/backends.py#L477-L478
- https://github.com/PyMoDAQ/PyMoDAQ/commit/041e8a22b3dbe3c986ec0ea3c6b46a22f5efe374
- https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042a58f5d4870a2b45fe2c9423aafe6b9203
- https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff74d82624c640bd79513f5b4675ea6d88da
- https://github.com/PyMoDAQ/PyMoDAQ/commit/ae0042513eb979c84da690825902658c625718d1
- https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/4.4.13
- https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.1.15
- https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.2.14
- https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.3.10
- https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84
- https://www.vulncheck.com/advisories/pymodaq-before-5.3.10-arbitrary-code-execution-via-crafted-hdf5-dock-layout-and-xml-settings-files
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-120499PoC
- CRITICALCVE-2017-20285PoC
- HIGHCVE-2019-25777PoC
- UNSCOREDCVE-2023-22793
- HIGHCVE-2024-42002PoC
- UNSCOREDCVE-2025-30047
- CRITICALCVE-2025-53837PoC
- CRITICALCVE-2025-59953PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.