CVE-2026-31072
CVE-2026-31072
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers
CVSS 9.8 · Critique · EPSS 0,8%
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
n/a
- Versions du logiciel
- n/a: Concernée
Aucun correctif publié
apscheduler PyPI
- Versions du logiciel
- 4.0.0a1
- 4.0.0a2
- 4.0.0a3
- 4.0.0a4
- 4.0.0a5
- 4.0.0a6
- Plages de versions concernées
- ECOSYSTEM: ≥ 4.0.0a1, ≤ 4.0.0a6
Aucun correctif publié
Sources originales
- https://github.com/agronholm/apscheduler
- https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6
- https://access.redhat.com/security/cve/CVE-2026-31072
- https://bugzilla.redhat.com/show_bug.cgi?id=2479907
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31072.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-31072