Log in Start free

Vulnerability · Published Jul 13, 2026 · Assigned by VulDB

CVE-2026-15529yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization

Medium 6.3

In plain English

A medium-severity unsafe deserialization in pyod from yzhao062. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 61.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is able to address this issue. It is recommended to apply a patch to fix this issue. The pull request to fix this issue requires some minor changes.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIpyod3.6.2GHSA-997v-r4v7-9f3g
PyPIpyod3.6.2PYSEC-2026-3909

Affected products (as reported)

VendorProductVersions
yzhao062 pyod 3.5.03.5.13.5.23.5.43.6.03.6.1

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References