Deserialization and Eval Injection Vulnerabilities in PyMoDAQ Products
CVE-2026-120859

8.5HIGH

Key Information:

Vendor

Pymodaq

Status
Pymodaq
Pymodaq Data
Pymodaq Gui
Pymodaq Utils
Vendor
CVE Published:
5 November 2026

What is CVE-2026-120859?

Multiple PyMoDAQ components are vulnerable to deserialization and evaluation of untrusted data, enabling attackers to execute arbitrary code through maliciously crafted files. This can occur via methods that do not properly sanitize input, such as StringARRAY.array_to_string(), JsonConverter.json2object(), and load_layout_state(), allowing unauthorized actions and potentially severe impacts on user systems.

Affected Version(s)

PyMoDAQ 0 < 4.4.13

pymodaq_data 0 < 5.1.15

pymodaq_data 5.2.0 < 5.2.14

References

https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GH...
vendor-advisory
https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff74d82624c...
patch
https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042a58f5d48...
patch

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dilanka Kaushal Hewage (r3vpwnx)
.