EUVD-2026-41736
GHSA-2rqq-j7w9-23vp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local CLI argument injection requires low privilege and no interaction; scope unchanged; limited CIA impact confined to the AD_Miner process.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of the file ad_miner/scripts/analyse_cache.py of the component Cache Handler. This manipulation of the argument sys.argv[1] causes deserialization. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.
AnalysisAI
Unsafe deserialization in AD-Security AD_Miner 1.9.0 allows a local low-privilege attacker to achieve code execution by supplying a crafted serialized payload as the sys.argv[1] argument to the Cache Handler's request_a function in analyse_cache.py. The attack is strictly local with no network exposure, and impacts confidentiality, integrity, and availability at a low level within the vulnerable process. No public exploit has been identified; an upstream fix exists as GitHub PR #239 but awaits acceptance, meaning no released patched version is currently available.
Technical ContextAI
CWE-502 (Deserialization of Untrusted Data) describes the root cause: the request_a function in ad_miner/scripts/analyse_cache.py passes attacker-controlled data from sys.argv[1] directly into a deserialization routine - likely Python's pickle module or equivalent - without sanitization or type validation. Deserialization of attacker-supplied objects can trigger arbitrary code execution during the object reconstruction phase, a well-understood Python attack class. The affected product is identified by CPE cpe:2.3:a:ad-security:ad_miner:*:*:*:*:*:*:*:* with version 1.9.0 explicitly named in the description. AD_Miner is an Active Directory security auditing tool that processes cached BloodHound/AD data, making its cache-handling pipeline a natural deserialization attack surface.
RemediationAI
The upstream fix is proposed in GitHub PR #239 (https://github.com/AD-Security/AD_Miner/pull/239), which awaits acceptance - a released patched version is not independently confirmed at time of analysis. Users should monitor the repository for PR merge and a tagged release, then upgrade immediately upon availability. As compensating controls until a patch ships: restrict execute permissions on ad_miner/scripts/analyse_cache.py to authorized administrators only, preventing low-privilege users from invoking the vulnerable function. Avoid running AD_Miner with command-line arguments sourced from untrusted or externally controlled inputs. Where possible, run AD_Miner in isolated, single-user environments (dedicated VMs or containers) where local access is already tightly controlled, reducing the practical attacker population to near zero.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today