Threats affecting pkg:github/treeio

Treeio versions up to 2.0 have an insecure deserialization vulnerability in the UpdateRecord.get_format_strings and ModuleSetting.loads functions. This flaw allows authenticated staff users to execute arbitrary Python code on the web server by storing crafted base64-encoded pickle payloads in the UpdateRecord format_strings field via the Django admin interface. The vulnerability arises from unverified deserialization of pickle data during news feed rendering.