Search
Find a vulnerability
Search criteria
1 vulnerability found for pymodaq_gui by PyMoDAQ
CVE-2026-120859 (GCVE-0-2026-120859)
Vulnerability from cvelistv5 – Published: 2026-11-05 17:14 – Updated: 2026-11-09 22:24
VLAI
EPSS
VEX
Title
PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files
Summary
PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:23 UTC
CWE
Assigner
VulnCheck
CNA
References
11 references
| URL | Tags |
|---|---|
| https://github.com/PyMoDAQ/PyMoDAQ/security/advis… | vendor-advisory |
| https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff7… | patch |
| https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042… | patch |
| https://github.com/PyMoDAQ/PyMoDAQ/commit/ae00425… | patch |
| https://github.com/PyMoDAQ/PyMoDAQ/commit/041e8a2… | patch |
| https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.3.10 | release-notes |
| https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.2.14 | release-notes |
| https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.1.15 | release-notes |
| https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/4.4.13 | release-notes |
| https://github.com/PyMoDAQ/PyMoDAQ/blob/5.3.9/pac… | technical-description |
| https://www.vulncheck.com/advisories/pymodaq-befo… | third-party-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| PyMoDAQ | PyMoDAQ |
Affected:
0 , < 4.4.13
(semver)
|
|
| PyMoDAQ | pymodaq_data |
Affected:
0 , < 5.1.15
(semver)
Affected: 5.2.0 , < 5.2.14 (semver) Affected: 5.3.0 , < 5.3.10 (semver) |
|
| PyMoDAQ | pymodaq_gui |
Affected:
0 , < 5.1.15
(semver)
Affected: 5.2.0 , < 5.2.14 (semver) Affected: 5.3.0 , < 5.3.10 (semver) |
|
| PyMoDAQ | pymodaq_utils |
Affected:
0 , < 5.1.15
(semver)
Affected: 5.2.0 , < 5.2.14 (semver) Affected: 5.3.0 , < 5.3.10 (semver) |
Date Public
2026-11-04 14:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120859",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:23:03.047870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:24:15.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymodaq",
"product": "PyMoDAQ",
"repo": "https://github.com/PyMoDAQ/PyMoDAQ",
"vendor": "PyMoDAQ",
"versions": [
{
"lessThan": "4.4.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymodaq-data",
"product": "pymodaq_data",
"repo": "https://github.com/PyMoDAQ/PyMoDAQ",
"vendor": "PyMoDAQ",
"versions": [
{
"lessThan": "5.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.2.14",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThan": "5.3.10",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymodaq-gui",
"product": "pymodaq_gui",
"repo": "https://github.com/PyMoDAQ/PyMoDAQ",
"vendor": "PyMoDAQ",
"versions": [
{
"lessThan": "5.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.2.14",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThan": "5.3.10",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/pymodaq-utils",
"product": "pymodaq_utils",
"repo": "https://github.com/PyMoDAQ/PyMoDAQ",
"vendor": "PyMoDAQ",
"versions": [
{
"lessThan": "5.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.2.14",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThan": "5.3.10",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dilanka Kaushal Hewage (r3vpwnx)"
}
],
"datePublic": "2026-11-04T14:53:53.000Z",
"descriptions": [
{
"lang": "en",
"value": "PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:14:58.101Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jw9g-5c9x-cf84)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff74d82624c640bd79513f5b4675ea6d88da"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042a58f5d4870a2b45fe2c9423aafe6b9203"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/commit/ae0042513eb979c84da690825902658c625718d1"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/commit/041e8a22b3dbe3c986ec0ea3c6b46a22f5efe374"
},
{
"name": "PyMoDAQ 5.3.10 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.3.10"
},
{
"name": "PyMoDAQ 5.2.14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.2.14"
},
{
"name": "PyMoDAQ 5.1.15 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.1.15"
},
{
"name": "PyMoDAQ 4.4.13 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/4.4.13"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/PyMoDAQ/PyMoDAQ/blob/5.3.9/packages/pymodaq_data/src/pymodaq_data/h5modules/backends.py#L477-L478"
},
{
"name": "VulnCheck Advisory: PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pymodaq-before-5.3.10-arbitrary-code-execution-via-crafted-hdf5-dock-layout-and-xml-settings-files"
}
],
"title": "PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120859",
"datePublished": "2026-11-05T17:14:58.101Z",
"dateReserved": "2026-11-03T00:37:48.051Z",
"dateUpdated": "2026-11-09T22:24:15.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}