What is the CVSS score of CVE-2026-31220?

CVE-2026-31220 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PySyft are affected by CVE-2026-31220?

PySyft Datasite/Server versions 0.9.5 and earlier contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary Python code on affected servers…

How to fix or mitigate CVE-2026-31220?

Within 24 hours: Identify all systems running PySyft Datasite/Server versions 0.9.5 or earlier and isolate them from production networks or disable remote function submission capabilities. Within 7 days: Implement network-level controls restricting access to PySyft instances to trusted internal networks only, and monitor for suspicious function submissions or Python code patterns. Within 30 days: Upgrade to PySyft version 0.9.6 or later when available from the vendor, or evaluate migration to alternative solutions if no patch is released.

PySyft CVE-2026-31220

EUVD-2026-29504 CRITICAL

Code Injection (CWE-94)

2026-05-12 mitre

GHSA-cfpg-c974-jfhq

Python RCE Code Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 21:30 vuln.today

CVSS changed

May 15, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on syft (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.9.5.

DescriptionCVE.org

PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxing of user-submitted code. The system allows low-privileged users to submit Python functions (via @sy.syft_function()) for remote execution on the server. While a code approval mechanism exists, the submitted code undergoes no security checks for dangerous operations (e.g., file access, command execution). Once approved, the code is executed within the server process using exec() and eval() functions without proper isolation. A remote attacker can leverage this to execute arbitrary Python code on the server, leading to complete compromise of the server environment.

AnalysisAI

Remote code execution in PySyft Datasite/Server versions 0.9.5 and earlier allows unauthenticated attackers to execute arbitrary Python code on the server through the function submission mechanism. The vulnerability stems from insufficient validation and sandboxing of user-submitted Python functions decorated with @sy.syft_function(), which are executed using unsafe exec() and eval() calls after approval. With an EPSS score of 0.04% and no current KEV listing, this appears to be a high-severity vulnerability without confirmed active exploitation.

Technical ContextAI

PySyft is a privacy-preserving machine learning framework that enables remote computation on distributed data. The vulnerability exists in the function submission mechanism where users can submit Python functions for remote execution on the Syft Datasite/Server. The root cause is CWE-94 (Code Injection), where user-supplied code is executed without proper validation or sandboxing. The system uses Python's exec() and eval() functions to run approved code directly within the server process, lacking isolation mechanisms like containerization or restricted execution environments.

RemediationAI

No vendor-released patch identified at time of analysis. The Notion advisory link (https://www.notion.so/CVE-2026-31220-35d1e1393188814186b9e00114a8aba7) may contain vendor guidance but requires access verification. As compensating controls: disable the @sy.syft_function() submission feature if not required, implement strict code review processes for all function approvals focusing on system calls and file operations, deploy the PySyft server in an isolated container or VM with minimal privileges, and monitor server processes for unexpected child process creation or file system modifications. Each control has trade-offs - disabling function submission breaks core functionality, manual review doesn't scale, and isolation adds operational complexity.