Description
A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is able to address this issue. It is recommended to apply a patch to fix this issue. The pull request to fix this issue requires some minor changes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| yzhao062 | pyod | 3.5.0, 3.5.1, 3.5.2, 3.5.4, 3.6.0, 3.6.1 | 3.6.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pyod | >= 3.5.0, < 3.6.2 | 3.6.2 | GHSA-997v-r4v7-9f3g |
References
- VDB-377872 | yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization vdb-entry technical-description
- VDB-377872 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-15529 | CVE Analysis and Report third-party-advisory
- Submit #854559 | Yue Zhao / yzhao062 pyod 3.5.0 through 3.5.2 CWE-502: Deserialization of Untrusted Data third-party-advisory
- https://github.com/yzhao062/pyod/issues/697 issue-tracking
- https://github.com/yzhao062/pyod/pull/698 issue-tracking patch
- https://pypi.org/project/pyod/3.6.2/ patch
- https://github.com/yzhao062/pyod/ product