Pymodaq_data (< 5.1.15, 5.2.x < 5.2.14, 5.3.x < 5.3.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pymodaq_data--5.1.15-5.2.x--5.2.14-5.3.x--5.3.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 20:29:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPyMoDAQ: Arbitrary code execution via insecure deserialization and eval injection (CVE-2026-120859)https://feed.craftedsignal.io/briefs/2026-11-pymodaq-rce/Thu, 05 Nov 2026 20:29:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pymodaq-rce/Multiple PyMoDAQ components are vulnerable to insecure deserialization and eval injection, allowing attackers to execute arbitrary code via crafted HDF5, .dock, or XML settings files.PyMoDAQ (before 4.4.13) and associated components (pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10) contain deserialization of untrusted data and eval injection vulnerabilities. These flaws allow attackers to execute arbitrary code by supplying crafted files that a user opens.

Exploitation vectors include:

  • HDF5 string nodes processed by StringARRAY.array_to_string() using pickle.loads().
  • HDF5 attributes processed by JsonConverter.json2object().
  • .dock files processed by load_layout_state() using unpickling.
  • XML settings files processed by elt_to_dict() and set_txt_from_elt().
]]>highadvisory