EUVD-2026-19235
GHSA-wc65-8wqw-hgc9
Severity by source
Sources disagree (Low–High)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx of the component trie File Handler. The manipulation results in deserialization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unsafe deserialization in pytries datrie through version 0.8.3 enables remote code execution when loading untrusted trie files via Trie.load(), Trie.read(), or Trie.__setstate__(). Unauthenticated remote attackers can exploit this vulnerability by crafting malicious serialized trie objects; publicly available exploit code exists, and the maintainers have not yet addressed the issue despite early notification.
Technical ContextAI
The datrie library (CPE: cpe:2.3:a:pytries:datrie:*:*:*:*:*:*:*:*) is a Python trie data structure implementation written in Cython that includes file deserialization functionality. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where the Trie.load(), Trie.read(), and Trie.__setstate__() methods in src/datrie.pyx unsafely deserialize trie objects without proper validation. This allows attackers to inject arbitrary Python objects during deserialization, leading to code execution. The attack surface is significant because trie files are often treated as data rather than executable code, causing developers to load them from untrusted sources without additional validation.
RemediationAI
Upgrade to a patched version of pytries datrie as soon as one is released by the maintainers; users should monitor GitHub issue #109 (https://github.com/pytries/datrie/issues/109) for patch availability. As an interim workaround, avoid loading trie files from untrusted or user-supplied sources; if file loading is required, validate file integrity using cryptographic signatures or checksums before deserialization. Consider sandboxing datrie operations or running the deserialization process in an isolated environment with minimal privileges. If the project remains unresponsive, evaluate alternative trie implementations that implement safe deserialization practices (e.g., using pickle protocols with restricted object loading or JSON-based serialization formats).
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today