GHSA-997v-r4v7-9f3g

PyOD persistence.load deserializes untrusted artifacts before validation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-15529

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pyod	>= 3.5.0, < 3.6.2	3.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix this issue requires some minor changes.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-15529 advisory
https://github.com/yzhao062/pyod/issues/697 web
https://github.com/yzhao062/pyod/pull/698 web
https://github.com/yzhao062/pyod/commit/16e6e3ad8921a4e18ccc8c2afe474db7d002c001 web
https://github.com/yzhao062/pyod package
https://github.com/yzhao062/pyod/releases/tag/v3.6.2 web
https://pypi.org/project/pyod/3.6.2 web
https://vuldb.com/cve/CVE-2026-15529 web
https://vuldb.com/submit/854559 web
https://vuldb.com/vuln/377872 web
https://vuldb.com/vuln/377872/cti web