Read the docs
TI-2026-85540 Aliases CVE-2026-120859

PyMoDAQ flaws let crafted files execute code on opening

Priority LOW 36CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, from 5.2.0 before 5.2.14, and from 5.3.0 before 5.3.10, contain deserialization of untrusted data (CWE-502) and eval injection flaws (CWE-95). An attacker who gets a user to open a crafted HDF5, dock layout, or XML settings file can execute arbitrary code, because pickled objects and Python expressions in these files are unpickled or evaluated when the file is read.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.

Why it matters now

EPSS 0.00192 8th percentileScored 2026-11-07
Fix Fixed PyMoDAQ (PyMoDAQ): 4.4.13pymodaq_data (PyMoDAQ): 5.1.15, 5.2.14, 5.3.10+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PyMoDAQPyMoDAQbefore 4.4.134.4.13Patch availableCNA
PyMoDAQpymodaq_databefore 5.1.15; 5.2.0 to before 5.2.14; 5.3.0 to before 5.3.105.1.15, 5.2.14, 5.3.10Patch availableCNA
PyMoDAQpymodaq_guibefore 5.1.15; 5.2.0 to before 5.2.14; 5.3.0 to before 5.3.105.1.15, 5.2.14, 5.3.10Patch availableCNA
PyMoDAQpymodaq_utilsbefore 5.1.15; 5.2.0 to before 5.2.14; 5.3.0 to before 5.3.105.1.15, 5.2.14, 5.3.10Patch availableCNA
  • PyMoDAQ VendorPyMoDAQ Affected before 4.4.13 Fixed in 4.4.13 Patch available CNA
  • pymodaq_data VendorPyMoDAQ Affected before 5.1.15; 5.2.0 to before 5.2.14; 5.3.0 to before 5.3.10 Fixed in 5.1.15, 5.2.14, 5.3.10 Patch available CNA
  • pymodaq_gui VendorPyMoDAQ Affected before 5.1.15; 5.2.0 to before 5.2.14; 5.3.0 to before 5.3.10 Fixed in 5.1.15, 5.2.14, 5.3.10 Patch available CNA
  • pymodaq_utils VendorPyMoDAQ Affected before 5.1.15; 5.2.0 to before 5.2.14; 5.3.0 to before 5.3.10 Fixed in 5.1.15, 5.2.14, 5.3.10 Patch available CNA

Remediation

Upgrade PyMoDAQ to 4.4.13. Upgrade pymodaq_data, pymodaq_gui, and pymodaq_utils to 5.1.15, 5.2.14, or 5.3.10, depending on the release branch in use.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA PyMoDAQ (PyMoDAQ) Fixed in 4.4.13
  • Fix · CNA pymodaq_data (PyMoDAQ) Fixed in 5.1.15, 5.2.14, 5.3.10
  • Fix · CNA pymodaq_gui (PyMoDAQ) Fixed in 5.1.15, 5.2.14, 5.3.10
  • Fix · CNA pymodaq_utils (PyMoDAQ) Fixed in 5.1.15, 5.2.14, 5.3.10

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-120859
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Patch 4

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences