EUVD-2026-43275
GHSA-997v-r4v7-9f3g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable deserialization requiring low-privilege authentication; no scope change and limited C/I/A impact consistent with constrained deployment exposure.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix this issue requires some minor changes.
AnalysisAI
Unsafe deserialization in pyod 3.5.0-3.5.2 exposes the pyod.utils.persistence.load function to remote exploitation by authenticated low-privilege users who can manipulate the path argument. Rooted in CWE-502 (Deserialization of Untrusted Data), the flaw allows a crafted serialized payload supplied via the path parameter to be deserialized without adequate validation, potentially yielding code execution or data manipulation within the running process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; an upstream fix is available as GitHub PR #698, though a formally versioned PyPI release incorporating the patch has not been independently confirmed.
Technical ContextAI
pyod (Python Outlier Detection) is an open-source Python library by yzhao062 providing algorithms for anomaly detection in machine learning pipelines. The affected component, pyod.utils.persistence.load in pyod/utils/persistence.py, is responsible for loading serialized model artifacts - most likely via Python's pickle or joblib deserialization mechanisms. CWE-502 (Deserialization of Untrusted Data) manifests when the path argument accepted by this function is attacker-influenced and passed directly to a deserialization routine without allowlisting or integrity validation. Deserializing attacker-controlled data using pickle-based formats is a well-known arbitrary code execution primitive in Python environments. Affected CPE is cpe:2.3:a:yzhao062:pyod:*:*:*:*:*:*:*:*, with versions 3.5.0, 3.5.1, and 3.5.2 explicitly confirmed. The GitHub issue tracker entry is https://github.com/yzhao062/pyod/issues/697.
RemediationAI
The primary remediation is to apply the upstream patch from GitHub pull request #698 (https://github.com/yzhao062/pyod/pull/698) once a tagged release incorporating the fix is published to PyPI; no formally versioned patched release has been independently confirmed at time of analysis, so monitor the pyod releases page and PyPI listing for an update. As an immediate compensating control, avoid passing any user-controlled, network-derived, or otherwise untrusted values to pyod.utils.persistence.load - restrict the path argument strictly to allowlisted, locally trusted file paths. If the persistence load function is exposed through an API or service layer, enforce authentication and role-based authorization to ensure only trusted operators can invoke it. Consider running deserialization operations in isolated process sandboxes (e.g., via subprocess with restricted OS permissions) to contain the blast radius if exploitation occurs. Pinning pyod to a pre-3.5.0 version may be appropriate as a short-term measure, contingent on verifying that earlier versions do not share the same code path.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today