Remote Code Execution Vulnerability in APScheduler by Agronholm
CVE-2026-31072

9.8CRITICAL

Key Information:

Vendor

Agronholm

Status
APScheduler
Vendor
CVE Published:
19 May 2026

What is CVE-2026-31072?

APScheduler contains a vulnerability in its JSONSerializer and CBORSerializer that exposes applications to Remote Code Execution due to insecure deserialization. The 'unmarshal_object' function permits the dynamic importing of modules and the invocation of setstate on any class, presenting an avenue for attackers to execute arbitrary code by sending crafted JSON or CBOR payloads. This vulnerability can compromise the integrity of applications reliant on APScheduler, making it essential for developers to review their deployment and implement proper validation mechanisms to safeguard against potential exploitation.

References

https://github.com/agronholm/apscheduler
https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.