CVE-2026-120859 in PyMoDAQ
Summary
by MITRE • 11/05/2026
PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The identified vulnerabilities represent critical security flaws within the PyMoDAQ software ecosystem, specifically affecting versions prior to 4.4.13 for the main package and various earlier releases of its constituent modules including pymodaq_data, pymodaq_gui, and pymodaq_utils. These components are susceptible to deserialization of untrusted data and arbitrary code execution via eval injection. The core issue stems from the improper handling of serialized objects and configuration files that contain executable Python payloads. When a user interacts with these crafted inputs through legitimate application functions, the software fails to validate or sanitize the content before processing it as trusted code, leading to remote code execution capabilities for an attacker who can trick a victim into opening maliciously constructed files.
In the pymodaq_data module, the vulnerability manifests within the HDF5 file handling mechanisms. Specifically, the StringARRAY.array_to_string() function is designed to process data stored in HDF5 string nodes. However, when this node is browsed or read by an application user, the function inadvertently passes the raw content of these strings directly into pickle.loads(). This allows an attacker to embed pickled Python objects within HDF5 files. Upon loading such a file, the deserialization process executes any arbitrary code contained within the serialized payload without prior validation. This vector is particularly dangerous because HDF5 is commonly used for scientific data storage, meaning users may routinely open datasets from external sources or collaborators under the assumption that they contain only raw numerical or categorical data rather than executable scripts.
A second attack vector exists in the pymodaq_gui module through its JSON conversion utilities. The JsonConverter.json2object() function processes attributes stored within HDF5 files by interpreting them as Python expressions and evaluating them using built-in evaluation mechanisms. If an attacker can manipulate these attributes, they can inject arbitrary Python code that will be executed during the parsing process. This vulnerability highlights a failure to distinguish between data values and executable logic in configuration or metadata fields. By placing malicious Python expressions within HDF5 attributes, an adversary ensures that any user who views or edits the associated file triggers immediate code execution on their local machine.
The Dashboard component of pymodaq_gui introduces another significant risk through its layout management features. The load_layout_state() function is responsible for restoring application states from saved configurations stored in .dock files. This function utilizes pickle to deserialize these state files, assuming they originate from trusted sources. An attacker can craft a malicious .dock file containing serialized payloads that exploit this deserialization process. When a user selects the Load layout action within the Dashboard interface and points it toward such a compromised file, the application automatically unpickles the content, resulting in arbitrary code execution. This vector is effective because users frequently share or download layout configurations to replicate experimental setups across different environments.
Furthermore, vulnerabilities exist in how XML settings files are processed by both pymodaq_gui and pymodaq_utils modules. The functions elt_to_dict() and set_txt_from_elt(), which parse XML elements into dictionary structures and extract text content respectively, contain logic that evaluates embedded Python expressions within the file contents. If an attacker embeds malicious code within specific fields of an XML settings file, this code is executed when the application reads or applies these settings. This affects configuration management workflows where users import custom setups or modify existing ones through graphical interfaces that rely on underlying XML parsing routines.
The operational impact of these vulnerabilities is severe, as they collectively enable remote code execution with the privileges of the user running the PyMoDAQ application. An attacker does not need network access to exploit these flaws; instead, social engineering tactics such as sending a malicious HDF5 dataset, JSON-embedded attribute file, .dock layout configuration, or XML settings file are sufficient to trigger exploitation. Successful exploitation grants full control over the victim's system, potentially leading to data theft, installation of malware, pivoting into internal networks, or complete compromise of scientific research integrity if experimental data is altered or exfiltrated.
These vulnerabilities align with CWE-502 Deserialization of Untrusted Data and CWE-94 Improper Control of Generation of Code Eval Injection in industry classification standards. From a threat modeling perspective utilizing the MITRE ATT&CK framework, these flaws facilitate initial access through lure-based techniques (T1566) and command execution via system commands or script interpretation (T1059). The reliance on legacy deserialization methods like pickle without integrity checks is a common pattern in scientific computing libraries that prioritizes convenience over security.
Mitigation strategies must prioritize immediate upgrading to patched versions of all affected components, specifically PyMoDAQ 4.4.13 and later, pymodaq_data/pymodaq_gui/pymodaq_utils version 5.1.15 or higher for the 5.1.x branch, version 5.2.14 or higher for the 5.2.x series, and version 5.3.10 or higher for the 5.3.x series. Until upgrades are feasible, organizations should implement strict file intake policies that prohibit opening untrusted HDF5 files, layout configurations, or XML settings from external sources within isolated virtual machines or sandboxed environments. Additionally, developers of dependent applications should refactor code to replace pickle-based deserialization with safer alternatives such as JSON for data interchange and avoid using eval() on any user-supplied input. Security awareness training should also be conducted to educate users about the risks associated with opening files from unknown origins in scientific software suites that handle complex serialization formats.