{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/pymodaq/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-120859"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PyMoDAQ (\u003c 4.4.13)","pymodaq_data (\u003c 5.1.15, 5.2.x \u003c 5.2.14, 5.3.x \u003c 5.3.10)","pymodaq_gui (\u003c 5.1.15, 5.2.x \u003c 5.2.14, 5.3.x \u003c 5.3.10)","pymodaq_utils (\u003c 5.1.15, 5.2.x \u003c 5.2.14, 5.3.x \u003c 5.3.10)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PyMoDAQ"],"content_html":"\u003cp\u003ePyMoDAQ (before 4.4.13) and associated components (pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10) contain deserialization of untrusted data and eval injection vulnerabilities. These flaws allow attackers to execute arbitrary code by supplying crafted files that a user opens.\u003c/p\u003e\n\u003cp\u003eExploitation vectors include:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eHDF5 string nodes processed by StringARRAY.array_to_string() using pickle.loads().\u003c/li\u003e\n\u003cli\u003eHDF5 attributes processed by JsonConverter.json2object().\u003c/li\u003e\n\u003cli\u003e.dock files processed by load_layout_state() using unpickling.\u003c/li\u003e\n\u003cli\u003eXML settings files processed by elt_to_dict() and set_txt_from_elt().\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T20:29:23Z","date_published":"2026-11-05T20:29:23Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pymodaq-rce/","summary":"Multiple PyMoDAQ components are vulnerable to insecure deserialization and eval injection, allowing attackers to execute arbitrary code via crafted HDF5, .dock, or XML settings files.","title":"PyMoDAQ: Arbitrary code execution via insecure deserialization and eval injection (CVE-2026-120859)","url":"https://feed.craftedsignal.io/briefs/2026-11-pymodaq-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - PyMoDAQ","version":"https://jsonfeed.org/version/1.1"}