EUVD-2026-29558
GHSA-g82g-j283-hj97
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 223 pypi packages depend on imgaug (122 direct, 102 indirect)
Ecosystem-wide dependent count for version 0.4.0.
DescriptionCVE.org
The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py module. The class uses Python's pickle module to deserialize data received via a multiprocessing queue in the _augment_images_worker() method without any safety checks. An attacker who can influence the data placed into this queue (e.g., through social engineering, malicious input scripts, or a compromised shared queue) can provide a malicious pickle payload. When deserialized, this payload can execute arbitrary code in the context of the worker process, leading to remote or local code execution depending on the deployment scenario.
AnalysisAI
Arbitrary code execution in imgaug library (versions through 0.4.0) occurs when the BackgroundAugmenter class deserializes malicious pickle payloads without validation in its multiprocessing worker method. Attackers who can influence queue data-through compromised shared queues, malicious input scripts, or social engineering-can achieve remote or local code execution depending on deployment context. CVSS 9.8 critical severity reflects network-based exploitation without authentication, though EPSS probability is low (0.02%, 6th percentile), indicating limited observed exploitation activity. No CISA KEV listing or public exploit code identified at time of analysis.
Technical ContextAI
The imgaug library is a Python-based image augmentation toolkit commonly used in machine learning pipelines. The vulnerability resides in the BackgroundAugmenter class within multicore.py, which implements parallel image processing using Python's multiprocessing module. The _augment_images_worker() method receives serialized data through a multiprocessing.Queue and deserializes it using pickle.loads() without validation. Python's pickle module is inherently unsafe for untrusted data because it can execute arbitrary Python code during deserialization by invoking the __reduce__ method on objects. This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), a well-documented dangerous pattern in Python applications. The affected CPE string (cpe:2.3:a:n/a:n/a) lacks vendor/product specificity in NVD data, but GitHub reference confirms the aleju/imgaug project as the affected codebase.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis. The imgaug GitHub repository (https://github.com/aleju/imgaug) shows the last release as 0.4.0 (February 2020), with no subsequent security updates addressing this CVE. In the absence of an official patch, implement these compensating controls with their respective trade-offs: (1) Replace BackgroundAugmenter with single-process augmentation using imgaug's standard Augmenter classes-this eliminates the vulnerable multiprocessing path but reduces performance for large-scale batch processing. (2) If parallel processing is required, sandbox BackgroundAugmenter worker processes using containerization (Docker with restricted capabilities, no network access) or process isolation mechanisms-this limits blast radius but adds deployment complexity and may impact performance. (3) Implement strict input validation to ensure only developer-controlled, trusted augmentation pipelines are executed-never deserialize augmentation configurations from user input, uploaded files, or external APIs. (4) Consider migrating to actively maintained alternatives like Albumentations or Kornia for production ML pipelines-imgaug's last commit was 2020 and may be abandoned. Monitor the GitHub repository and NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-31235) for future security advisories.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today