CVE-2026-15529: Deserialization in yzhao062 pyod
A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is able to address this issue. It is recommended to apply a patch to fix this issue. The pull request to fix this issue requires some minor changes.
AI Analysis
Technical Summary
The vulnerability in yzhao062 pyod up to version 3.6.1 involves unsafe deserialization in the pyod.utils.persistence.load function. An attacker can manipulate the 'path' argument to trigger deserialization, potentially leading to security risks. The vulnerability is fixed in version 3.6.2. The CVSS 4.0 base score is 5.3 (medium severity), with network attack vector, low attack complexity, and no user interaction required.
Potential Impact
Successful exploitation allows remote attackers to perform deserialization through manipulation of the 'path' argument in the load function, which may lead to execution of arbitrary code or other deserialization-related impacts. The CVSS score of 5.3 indicates a moderate impact with potential confidentiality, integrity, and availability losses at low levels.
Mitigation Recommendations
Upgrade pyod to version 3.6.2 or later to apply the official fix for this vulnerability. The vendor has released a patch addressing this issue. No additional mitigation steps are indicated.
CVE-2026-15529: Deserialization in yzhao062 pyod
Description
A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is able to address this issue. It is recommended to apply a patch to fix this issue. The pull request to fix this issue requires some minor changes.
CVSS v4.0
Score 5.3medium
Affected software
cpe:2.3:a:yzhao062:pyod:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in yzhao062 pyod up to version 3.6.1 involves unsafe deserialization in the pyod.utils.persistence.load function. An attacker can manipulate the 'path' argument to trigger deserialization, potentially leading to security risks. The vulnerability is fixed in version 3.6.2. The CVSS 4.0 base score is 5.3 (medium severity), with network attack vector, low attack complexity, and no user interaction required.
Potential Impact
Successful exploitation allows remote attackers to perform deserialization through manipulation of the 'path' argument in the load function, which may lead to execution of arbitrary code or other deserialization-related impacts. The CVSS score of 5.3 indicates a moderate impact with potential confidentiality, integrity, and availability losses at low levels.
Mitigation Recommendations
Upgrade pyod to version 3.6.2 or later to apply the official fix for this vulnerability. The vendor has released a patch addressing this issue. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-12T15:47:24.318Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5463f568715ace431cdca2
Added to database: 07/13/2026, 04:05:09 UTC
Last enriched: 07/20/2026, 18:07:42 UTC
Last updated: 08/25/2026, 10:52:07 UTC
Views: 110
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.