Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-31048 Details

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

An issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled string message.

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/irmen/Pyro3/blob/master/docs/9-security.html#L341-L346	[email protected]	Technical DescriptionVendor
https://github.com/irmen/Pyro3/blob/master/Pyro/protocol.py#L672-L711	[email protected]	Source CodeVendor
https://github.com/Sif-0x01/security-advisories/security/advisories/GHSA-7625-w9h5-83rv	[email protected]	AdvisoryRemedy

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	CISA-ADP

Product	Versions
irmen Pyro	<= 3.16
CPE cpe:2.3:a:pyro_project:pyro:::::::: Remediation Upgrade: 5moderate effort Workaround:moderate effort Migrate to Pyro 5, which uses the 'serpent' serializer by default and does not deserialize pickle from untrusted sources unless explicitly configured. Mitigation:low effort Ensure Pyro 3.x is never exposed to untrusted networks and is used only over fully trusted channels.

4 change records found show changes

QUICK INFO