CVE-2026-120859

Name of the Vulnerable Software and Affected Versions PyMoDAQ versions prior to 4.4.13 pymodaq data versions prior to 5.1.15 pymodaq gui versions prior to 5.1.15 pymodaq utils versions prior to 5.1.15 pymodaq data versions 5.2.x through 5.2.13 pymodaq gui versions 5.2.x through 5.2.13 pymodaq utils versions 5.2.x through 5.2.13 pymodaq data versions 5.3.x through 5.3.9 pymodaq gui versions 5.3.x through 5.3.9 pymodaq utils versions 5.3.x through 5.3.9

Description Deserialization of untrusted data and eval injection allow attackers to execute arbitrary code when a user opens a crafted file. This occurs through several vectors: storing pickled objects in HDF5 string nodes processed by StringARRAY.array to string() via pickle.loads(), placing Python expressions in HDF5 attributes evaluated by JsonConverter.json2object(), providing a .dock file that load layout state() unpickles during the Dashboard Load layout action, or embedding Python expressions in XML settings files evaluated by elt to dict() and set txt from elt(). Deserialization is the process of converting data from a format like a file back into an object, and eval injection occurs when an application executes untrusted input as code.

Recommendations Update PyMoDAQ to version 4.4.13 or later. Update pymodaq data to version 5.1.15 or later, 5.2.14 or later, or 5.3.10 or later. Update pymodaq gui to version 5.1.15 or later, 5.2.14 or later, or 5.3.10 or later. Update pymodaq utils to version 5.1.15 or later, 5.2.14 or later, or 5.3.10 or later.