Insecure deserialization in Treeio allows code execution
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
Treeio through 2.0 deserializes pickle data without verification in UpdateRecord.get_format_strings and ModuleSetting.loads, which is CWE-502. A staff user with high privileges can store a crafted base64 pickle value in an UpdateRecord format_strings field through the Django admin. The injected Python code runs as the web server user when news feeds render.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| treeio | treeio | up to 2.0 | — | No fix listed | CNA |
- treeio Vendortreeio Affected up to 2.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for treeio.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-124318
- 2026-11-07 Alias added: GHSA-3rqm-3mpx-jvr5
References
Other 4
Sources
- CVE-2026-124318 · CVE Program
- CVE-2026-124318 · NVD
- GHSA-3rqm-3mpx-jvr5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences