imgaug CVE-2026-31235

Exploitation requires the attacker to control or influence data placed into the multiprocessing.Queue consumed by BackgroundAugmenter's _augment_images_worker() method. Specific enabling conditions include: (1) Applications that accept user-supplied augmentation pipeline definitions (Python scripts, serialized configurations, or parameters) and pass them to BackgroundAugmenter, (2) Multi-tenant ML platforms where shared processing infrastructure allows cross-tenant queue access, or (3) Compromised upstream components (data loaders, configuration systems) that feed into the augmentation queue. Standard ML training pipelines with developer-controlled, hardcoded augmentation configurations are NOT vulnerable because the queue data originates from trusted code. The CVSS vector AV:N/AC:L/PR:N/UI:N reflects the worst-case scenario where user input directly flows to the queue, but most deployments limit exploitation to authenticated users or require social engineering to introduce malicious augmentation scripts. The vulnerability is NOT exploitable against default configurations where augmentation pipelines are statically defined in application code.

While the CVSS vector (AV:N/AC:L/PR:N/UI:N) suggests critical network-based exploitation without authentication, the real-world risk requires contextual analysis of conflicting signals. The 9.8 CVSS score assumes an attacker can remotely inject data into the multiprocessing queue, which is architecturally unlikely in typical deployments where queues are process-local. The EPSS score of 0.02% (6th percentile) indicates minimal observed exploitation attempts in the wild, suggesting the theoretical attack surface doesn't translate to widespread practical exploitation. The description explicitly notes prerequisite conditions: 'attacker who can influence the data placed into this queue' through social engineering, malicious input scripts, or compromised shared queues. This limits exploitation to scenarios where: (1) the imgaug library processes untrusted user-supplied augmentation pipelines, (2) the application architecture exposes the multiprocessing queue to external influence, or (3) an attacker has already compromised adjacent components. For standard ML training pipelines using imgaug with developer-controlled code, the risk is low. For applications accepting user-defined augmentation configurations or operating in multi-tenant environments with shared processing infrastructure, the risk is genuinely critical. No CISA KEV listing suggests nation-state or criminal exploitation campaigns have not been observed. Priority should be high for user-facing services accepting augmentation definitions, but lower for isolated training environments.

An attacker identifies a web service that accepts user-uploaded Python scripts defining custom imgaug augmentation pipelines for batch image processing. The service uses BackgroundAugmenter for parallel execution. The attacker crafts a malicious pickle payload disguised as an augmentation configuration that, when deserialized by _augment_images_worker(), executes a reverse shell connecting to attacker infrastructure. Upon submission, the worker process deserializes the payload, establishes the reverse shell, and grants the attacker code execution within the application's security context, potentially accessing training data, model weights, or pivoting to adjacent cloud resources.