CVE-2026-120859
Description
PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.
How to fix
- PyMoDAQ PyMoDAQ4.4.13 or later
- PyMoDAQ pymodaq_data5.1.15, 5.2.14, 5.3.10 or later
- PyMoDAQ pymodaq_gui5.1.15, 5.2.14, 5.3.10 or later
- PyMoDAQ pymodaq_utils5.1.15, 5.2.14, 5.3.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PyMoDAQ PyMoDAQ | v < 4.4.13 | 4.4.13 |
| PyMoDAQ pymodaq_data | v < 5.1.15, 5.2.0 ≤ v < 5.2.14, 5.3.0 ≤ v < 5.3.10 | 5.1.15, 5.2.14, 5.3.10 |
| PyMoDAQ pymodaq_gui | v < 5.1.15, 5.2.0 ≤ v < 5.2.14, 5.3.0 ≤ v < 5.3.10 | 5.1.15, 5.2.14, 5.3.10 |
| PyMoDAQ pymodaq_utils | v < 5.1.15, 5.2.0 ≤ v < 5.2.14, 5.3.0 ≤ v < 5.3.10 | 5.1.15, 5.2.14, 5.3.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.