The pytries datrie library up to version 0.8.3 contains a deserialization vulnerability in the Trie.load, Trie.read, and Trie.__setstate__ functions of src/datrie.pyx. This flaw allows remote attackers to manipulate deserialization processes, potentially leading to security issues. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating that it is remotely exploitable without privileges but requires user interaction and results in low confidentiality, integrity, and availability impacts. The project has been informed but has not issued a patch or official remediation.

Successful exploitation could allow an attacker to manipulate deserialization in the trie file handler, potentially leading to unauthorized code execution or data manipulation. However, the impact is rated medium with low confidentiality, integrity, and availability impacts. No confirmed exploits in the wild have been reported, but public exploit information exists.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the pytries project for updates and consider avoiding or restricting use of affected versions (0.8.0 through 0.8.3) until a patch is released. Implementing application-level controls to validate or restrict input to the vulnerable functions may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.