The vulnerability CVE-2026-15529 affects the pyod Python library in versions 3.5.0, 3.5.1, and 3.5.2. It arises from insecure deserialization in the pyod.utils.persistence.load function, which processes a path argument that can be manipulated by an attacker. This manipulation leads to deserialization of untrusted data, potentially allowing remote attackers to execute arbitrary code or cause other impacts associated with unsafe deserialization. A pull request addressing the issue exists but requires minor changes before it can be merged and released.

Exploitation of this vulnerability could allow remote attackers to perform unsafe deserialization, potentially leading to arbitrary code execution or other impacts typical of deserialization flaws. The CVSS 4.0 base score is 5.3 (medium), indicating a moderate risk with network attack vector, low complexity, no user interaction, and limited privileges required.

No official fix or patch has been released yet. A pull request to fix the issue is pending with minor changes required. Users should monitor the vendor's repository or advisory channels for the official patch and avoid using the affected versions (3.5.0, 3.5.1, 3.5.2) in production environments until the fix is released.