VulnSocial

CVE-2026-15529Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is able to address this issue. It is recommended to apply a patch to fix this issue. The pull request to fix this issue requires some minor changes.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-20CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-13: 2Patch / Workaround · 2026-07-13: 1Technical Details · 2026-07-13: 207-13
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • TECHEPAGES@techepages
    Patch

    🚨 CVE-2026-15529: deserialization flaw in Python's pyod library — loading an untrusted model file via persistence.load() can lead to arbitrary code execution 🔹 joblib.load() runs BEFORE any envelope validation — malicious pickle executes on load 🔹 Affects pyod 3.5.0–3.5.2; fix proposed requiring explicit trusted=True flag 🔹 ML pipelines loading models from registries, shared folders or user uploads most at risk 🔹 Mitigate: only load trusted artifacts, verify signatures/checksums & sandbox loading flows

    Post summary

    The tweet announces CVE-2026-15529, details a deserialization flaw in pyod, and outlines a mitigation involving a trusted flag and additional safeguards.

    0000043
    19 followersView on X
  • SecNews@SecNews_GR
    Disclosure

    CVE-2026-15529: pyod deserialization κίνδυνος στο persistence.load https://secn.ws/p3yZdh

    Post summary

    The post announces CVE‑2026‑15529 as a PyOD deserialization risk, offering minimal technical context but lacking any PoC, exploit, patch, or evidence of active exploitation.

    00000107
    7.0K followersView on X

Explore more

Back to dashboard