CVE-2026-120859

Received Received - Intake

PyMoDAQ Arbitrary Code Execution via Deserialization

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description

PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-05

Last Modified

2026-11-05

Generated

2026-11-06

AI Q&A

2026-11-06

EPSS Evaluated

N/A

NVD

CVE-2026-120859

EUVD

EUVD-2026-117605

Affected Vendors & Products

Vendor	Product	Version / Range
PyMoDAQ	PyMoDAQ	0
PyMoDAQ	pymodaq_data	0
PyMoDAQ	pymodaq_data	5.2.0
PyMoDAQ	pymodaq_data	5.3.0
PyMoDAQ	pymodaq_gui	0
PyMoDAQ	pymodaq_gui	5.2.0
PyMoDAQ	pymodaq_gui	5.3.0
PyMoDAQ	pymodaq_utils	0
PyMoDAQ	pymodaq_utils	5.2.0
PyMoDAQ	pymodaq_utils	5.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2026-120859 is a vulnerability in PyMoDAQ and related packages that allows arbitrary code execution through crafted files. It stems from unsafe deserialization and evaluation of data in HDF5 files, dock layout files, XML settings, and Data Mixer formulas. Attackers can embed malicious Python code in these files, which executes when opened by a user.

Detection Guidance

Detect this vulnerability by checking installed PyMoDAQ versions. Run commands like 'pip show pymodaq', 'pip show pymodaq_data', 'pip show pymodaq_gui', or 'pip show pymodaq_utils' to identify versions below 5.3.10, 5.2.14, 5.1.15, or 4.4.13. Inspect HDF5 files for embedded pickled objects or Python expressions in attributes. Review .dock files for non-JSON content and XML settings for eval usage.

Impact Analysis

If exploited, this vulnerability allows attackers to run arbitrary code on your system with the same privileges as the user running PyMoDAQ. This could lead to data theft, system compromise, or further network infiltration. The attack requires user interaction, such as opening a malicious file.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using vulnerable PyMoDAQ versions may face compliance breaches if exploited.

Mitigation Strategies

Immediately update PyMoDAQ and related packages to versions 5.3.10 or later, 5.2.14, 5.1.15, or 4.4.13. Avoid opening files from untrusted sources. Use the pymodaq_migrate command to convert legacy files safely. Ensure strings in HDF5 files are stored as plain UTF-8 and dock layout files as JSON.

Hi! I’m here to help you understand CVE-2026-120859. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...