The APScheduler library's JSONSerializer and CBORSerializer are vulnerable to remote code execution via insecure deserialization. The unmarshal_object function permits dynamic module imports and calls to __setstate__, enabling attackers to instantiate arbitrary classes and inject malicious state. This flaw affects all versions including 3.10.x and 4.0.0a5. Exploitation requires an attacker to submit crafted JSON or CBOR payloads to an application using these serializers. No CVSS score or official remediation is currently published, and no known exploits have been observed.

Successful exploitation allows remote code execution on the affected system by leveraging insecure deserialization to instantiate arbitrary classes and inject malicious state. This can lead to full compromise of the application environment where APScheduler is used. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid deserializing untrusted JSON or CBOR data with APScheduler's JSONSerializer or CBORSerializer. Consider implementing input validation or using alternative safe serialization methods.