EUVD-2026-26483Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
The LabOne Q serialization framework uses a class-loading mechanism (import_cls) to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted arbitrary fully-qualified class names from the serialized data without any validation of the target class or restriction on which modules could be imported. An attacker can craft a serialized experiment file that causes the deserialization engine to import and instantiate arbitrary Python classes with attacker-controlled constructor arguments, resulting in arbitrary code execution in the context of the user running the Python process. Exploitation requires the victim to load a malicious file using LabOne Q's deserialization functions, for example a compromised experiment file shared for collaboration or support purposes.
AnalysisAI
Unsafe deserialization in Zurich Instruments LabOne Q enables arbitrary code execution when users load malicious experiment files. The import_cls mechanism accepts unvalidated class names from serialized data, allowing attackers to instantiate arbitrary Python classes with controlled constructor arguments. Exploitation requires user interaction to open a crafted file, making this a credible vector for supply chain attacks via shared experiment configurations or support tickets. CVSS 8.4 reflects local attack vector with user interaction requirement. No confirmed active exploitation or public POC at time of analysis.
Technical ContextAI
LabOne Q is a quantum computing software framework by Zurich Instruments for programming and executing quantum experiments. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data) in the serialization framework's class-loading mechanism. Python's dynamic import system allows arbitrary module and class instantiation via __import__ or importlib. The import_cls function processes fully-qualified class names (e.g., os.system, subprocess.Popen) from serialized experiment data without allowlisting safe modules or validating class types. This enables attackers to reference dangerous classes like subprocess.Popen, os.system, or eval wrappers, passing malicious constructor arguments through the deserialization process. The affected product per CPE is cpe:2.3:a:zurich_instruments:labone_q (all versions prior to fix).
RemediationAI
Upgrade to the patched version of LabOne Q specified in Zurich Instruments security advisory ZI-SA-2026-002 at https://www.zhinst.com/support/security/2026/zi-sa-2026-002/. Until patching, implement these compensating controls: (1) Restrict experiment file sources to trusted collaborators only - verify file provenance through secure channels before loading, trading operational convenience for security. (2) Execute LabOne Q in sandboxed Python environments (Docker containers with restricted capabilities, Python virtual environments with limited module access) to contain potential code execution, accepting performance overhead and setup complexity. (3) Implement file inspection workflows where experiment files undergo manual review or static analysis before deserialization in production systems, adding latency to research workflows. (4) Disable automatic file association for LabOne Q experiment formats to prevent accidental double-click execution of malicious files. (5) Apply least-privilege principles to user accounts running LabOne Q processes, limiting blast radius of successful exploitation but potentially breaking workflows requiring elevated permissions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today