Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-120859PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files

High 7.8

In plain English

A high-severity unsafe deserialization in PyMoDAQ from PyMoDAQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 91.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.

Affected products (as reported)

VendorProductVersions
PyMoDAQ PyMoDAQ 0 – before 4.4.13
PyMoDAQ pymodaq_data 0 – before 5.1.155.2.0 – before 5.2.145.3.0 – before 5.3.10
PyMoDAQ pymodaq_gui 0 – before 5.1.155.2.0 – before 5.2.145.3.0 – before 5.3.10
PyMoDAQ pymodaq_utils 0 – before 5.1.155.2.0 – before 5.2.145.3.0 – before 5.3.10

Weakness: CWE-502, CWE-95 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References