Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-15529— yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization

Quick assessment

Affected

yzhao062 pyod

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

yzhao062 pyod是yzhao062个人开发者的一个机器学习异常检测工具包。 yzhao062 pyod 3.5.0版本、3.5.1版本和3.5.2版本存在输入验证错误漏洞，该漏洞源于pyod/utils/persistence.py文件中pyod.utils.persistence.load函数对参数路径操作导致反序列化。

CVSS 6.3 · Medium EPSS 0.44% · P38 Updated Jul 20, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 7

Vendor	Product	Version Range	Status
yzhao062	pyod	`3.5.0`	affected
		`3.5.1`	affected
		`3.5.2`	affected
		`3.5.4`	affected
		`3.6.0`	affected
		`3.6.1`	affected
		`3.6.2`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15529

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is able to address this issue. It is recommended to apply a patch to fix this issue. The pull request to fix this issue requires some minor changes.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Vulnerability Title

yzhao062 pyod 输入验证错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
yzhao062	pyod	3.5.0	`cpe:2.3:a:yzhao062:pyod::::::::`

II. Public POCs for CVE-2026-15529

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-15529

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-15529 (1)

🔗 Require explicit trust for persistence.load by 3em0 · Pull Request #698 · yzhao062/pyod · GitHub Read full article issue-tracking patch

Other References for CVE-2026-15529 (1)

🔗 Security: persistence.load unpickles artifacts before envelope validation · Issue #697 · yzhao062/pyod Read full article issue-tracking

https://www.cve.org/CVERecord?id=CVE-2026-15529

IV. Related Vulnerabilities

Same weakness: CWE-502