Vulnerability · Published Apr 6, 2026 · Assigned by VulDB

CVE-2026-5659pytries datrie trie File datrie.pyx Trie.setstate deserialization

Medium 6.3

In plain English

A medium-severity unsafe deserialization in datrie from pytries. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx of the component trie File Handler. The manipulation results in deserialization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
pytries	datrie	0.8.00.8.10.8.20.8.3

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-355483 | pytries datrie trie File datrie.pyx Trie.__setstate__ deserialization vdb-entry, technical-description
VDB-355483 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #785228 | pytries datrie 0.8.3 Deserialization third-party-advisory
https://github.com/pytries/datrie/issues/109 issue-tracking
https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/dartie_code_exec.md exploit
https://github.com/pytries/datrie/ product