CVE-2026-14723 Details
Description
A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of the file ad_miner/scripts/analyse_cache.py of the component Cache Handler. This manipulation of the argument sys.argv[1] causes deserialization. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.
A vulnerability in AD-Security AD_Miner version 1.9.0 allows for unsafe deserialization in the Cache Handler component. The issue arises in the function request_a within the file ad_miner/scripts/analyse_cache.py. This vulnerability can be exploited locally by manipulating the argument sys.argv[1], leading to the execution of arbitrary Python code under the account running the script. The problem is particularly concerning when cache files from other users or customers are loaded, as they could contain crafted payloads that execute harmful code.
A pull request has been made to address this vulnerability by restricting the deserialization of cache files. This pull request is currently awaiting acceptance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 5, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/847672?__cf_chl_f_tk=OMGtGTdlFc9MbAYE2yL37Va0.8fqbuwXCbUhJ7jVF8w-1783360226-1.0.1.1-06NIwDTuA.wmgvZmcy.dqKMaKSq8Jqm4cv6OH8kKfxw | CISA-ADP | |
| https://github.com/AD-Security/AD_Miner/ | [email protected] | ProductVendor |
| https://github.com/AD-Security/AD_Miner/issues/238 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/AD-Security/AD_Miner/pull/239 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-14723 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/847672 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/376310 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/376310/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AD-Security AD_Miner | 1.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 5, 2026 | New CVE Received | [email protected] |