CVE-2026-31235 Details

A vulnerability allowing insecure deserialization has been identified in the imgaug library, specifically in versions through 0.4.0. The issue resides in the BackgroundAugmenter class within the multicore.py module. This vulnerability arises because the class utilizes Python's pickle module to deserialize data from a multiprocessing queue in the _augment_images_worker() method, without implementing any safety checks. An attacker who can manipulate the data sent to this queue—potentially through social engineering, malicious input scripts, or a compromised shared queue—could inject a harmful pickle payload. Once deserialized, this payload has the capability to execute arbitrary code within the worker process, leading to either remote or local code execution, depending on the deployment scenario.