CVE-2026-15529CWE-20CWE-502

yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization

Medium · published July 13, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is able to address this issue. It is recommended to apply a patch to fix this issue. The pull request to fix this issue requires some minor changes.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00441 · 37.3th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-07-13T03:45Z
EPSS history
Timeline
  • 13 JUL 03:45Z
    yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization
    cvelistv5