PyMoDAQ: Arbitrary code execution via insecure deserialization and eval injection (CVE-2026-120859)
Multiple PyMoDAQ components are vulnerable to insecure deserialization and eval injection, allowing attackers to execute arbitrary code via crafted HDF5, .dock, or XML settings files.
CVE search metadata
CVE search record: CVE-2026-120859. Severity: high. CVSS: 7.8. KEV: no. Product: PyMoDAQ (< 4.4.13), pymodaq_data (< 5.1.15, 5.2.x < 5.2.14, 5.3.x < 5.3.10), pymodaq_gui (< 5.1.15, 5.2.x < 5.2.14, 5.3.x < 5.3.10), pymodaq_utils (< 5.1.15, 5.2.x < 5.2.14, 5.3.x < 5.3.10). Brief: PyMoDAQ: Arbitrary code execution via insecure deserialization and eval injection (CVE-2026-120859). Brief link: https://feed.craftedsignal.io/briefs/2026-11-pymodaq-rce/
Triage facts
Revision 1- Applicability
- PyMoDAQ (< 4.4.13), pymodaq_data (< 5.1.15, 5.2.x < 5.2.14, 5.3.x < 5.3.10) +2
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 20:29 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
PyMoDAQ (before 4.4.13) and associated components (pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10) contain deserialization of untrusted data and eval injection vulnerabilities. These flaws allow attackers to execute arbitrary code by supplying crafted files that a user opens.
Exploitation vectors include:
- HDF5 string nodes processed by StringARRAY.array_to_string() using pickle.loads().
- HDF5 attributes processed by JsonConverter.json2object().
- .dock files processed by load_layout_state() using unpickling.
- XML settings files processed by elt_to_dict() and set_txt_from_elt().