CVE-2026-5659 Details

A critical vulnerability allowing arbitrary code execution has been identified in the pytries datrie library, specifically in versions through 0.8.3. The issue arises from the datrie.Trie class's use of pickle for deserialization in the Trie.load(), Trie.read(), and Trie.__setstate__() methods. This creates a deserialization vulnerability, as a crafted .trie file can embed a malicious pickle payload that executes arbitrary Python code when the file is loaded. The vulnerability is not present in the datrie.BaseTrie class, which does not utilize pickle. The exploitation can be performed remotely, without authentication, but requires user interaction.

Users are advised to update to a version of the pytries datrie library that has addressed this vulnerability. If no such version is available, consider replacing the library with an alternative that does not have this deserialization issue.