CVE-2026-15529: PyOD Deserialization RCE Vulnerability

CVE-2026-15529 Overview

CVE-2026-15529 is an insecure deserialization vulnerability in the pyod Python library, an open-source toolkit for outlier detection developed by yzhao062. The flaw affects versions up to and including 3.6.1 and resides in the pyod.utils.persistence.load function defined in pyod/utils/persistence.py. An attacker who can influence the path argument passed to this function can trigger deserialization of untrusted data. The issue is classified under CWE-20 Improper Input Validation and can be initiated remotely. Version 3.6.2 addresses the vulnerability.

Critical Impact
An attacker able to control the file path or file contents loaded by pyod.utils.persistence.load can execute unsafe deserialization, potentially leading to arbitrary code execution within the host Python process.

Affected Products

yzhao062 pyod versions up to and including 3.6.1
Python applications and ML pipelines that call pyod.utils.persistence.load
Downstream projects consuming the pyod package from PyPI

Discovery Timeline

2026-07-13 - CVE-2026-15529 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-15529

Vulnerability Analysis

The vulnerability resides in the load function of pyod/utils/persistence.py, which is used to restore persisted pyod model objects from disk. The function deserializes data referenced by the path argument without adequate validation of the source or contents. When an attacker controls the path value or can substitute the file it references, deserialization proceeds on attacker-supplied bytes.

Python deserialization routines commonly used for model persistence, such as pickle, execute arbitrary code embedded in the serialized stream during object reconstruction. As a result, this class of flaw typically maps to remote code execution in the context of the application invoking load. See the pull request that fixes this issue and the linked issue report for maintainer context.

Root Cause

The root cause is improper input validation ([CWE-20]) around a deserialization sink. The load function accepts a path argument and reconstructs Python objects from the file without enforcing constraints on the origin, integrity, or structure of the serialized data. Trust in the caller-supplied argument is implicit rather than verified.

Attack Vector

The attack vector is network-adjacent to the application layer. Exploitation is feasible whenever pyod.utils.persistence.load is invoked with a path derived from untrusted input, including user-uploaded model files, remotely-fetched artifacts, or shared storage locations writable by lower-privileged actors. The CVSS 4.0 vector indicates low attacker privileges are required and no user interaction is needed.

A typical exploitation pattern involves an adversary planting a crafted serialized object at a location the target application reads, then waiting for the application to call load on that path. Because reconstruction of the serialized object can trigger constructor logic, arbitrary Python code executes with the privileges of the loading process.

No verified public proof-of-concept code is referenced in the advisory data. Refer to the VulDB entry for CVE-2026-15529 and the pyod GitHub repository for further technical background.

Detection Methods for CVE-2026-15529

Indicators of Compromise

Unexpected child processes spawned by Python interpreters that import pyod, especially shells or network utilities.
Outbound network connections initiated shortly after calls to pyod.utils.persistence.load.
Presence of untrusted or unexpected serialized model files (.pkl, .joblib) in directories referenced by application code.

Detection Strategies

Perform software composition analysis to identify pyod versions at or below 3.6.1 across build artifacts, container images, and virtual environments.
Instrument application code paths that call pyod.utils.persistence.load to log the resolved absolute path and file hash before deserialization.
Alert on Python processes that write executable payloads or invoke os.system, subprocess.Popen, or socket APIs immediately after model load operations.

Monitoring Recommendations

Monitor file integrity on directories storing serialized pyod models and flag writes from unexpected identities.
Track PyPI dependency changes in CI/CD to detect installations of pyod versions below 3.6.2.
Capture and retain process lineage telemetry for services performing model loading to support incident investigation.

How to Mitigate CVE-2026-15529

Immediate Actions Required

Upgrade pyod to version 3.6.2 or later across all environments, including production, staging, and developer workstations.
Audit all invocations of pyod.utils.persistence.load and confirm that the path argument cannot be influenced by untrusted input.
Restrict filesystem permissions on directories containing serialized pyod models so that only trusted identities can write to them.

Patch Information

The maintainers released pyod3.6.2 on PyPI, which contains the fix. See the PyPI release page for pyod 3.6.2 and the merged pull request #698. The advisory notes that the pull request may require minor additional changes, so verify the fix is present in the installed version.

Workarounds

Load only model files produced and stored by trusted internal systems, and reject any externally sourced serialized artifacts.
Validate model files with cryptographic signatures or checksums before invoking pyod.utils.persistence.load.
Run model-loading services with least-privilege accounts and network egress controls to limit blast radius if deserialization is abused.

bash

# Configuration example
pip install --upgrade 'pyod>=3.6.2'
pip show pyod | grep -i version