CVE-2026-31235: imgaug Library RCE Vulnerability

CVE-2026-31235 Overview

CVE-2026-31235 is an insecure deserialization vulnerability in the imgaug Python image augmentation library through version 0.4.0. The flaw resides in the BackgroundAugmenter class within the multicore.py module. The class uses Python's pickle module to deserialize data received from a multiprocessing queue inside the _augment_images_worker() method without any integrity or type validation. An attacker who can place data into the shared queue can supply a crafted pickle payload. When the worker process deserializes the payload, arbitrary code executes in the context of that worker. The weakness is tracked as CWE-502: Deserialization of Untrusted Data.

Critical Impact
Successful exploitation results in arbitrary code execution in worker processes that consume the multiprocessing queue, enabling remote or local compromise of machine learning pipelines using imgaug.

Affected Products

imgaug library versions up to and including 0.4.0
Python applications and ML pipelines that invoke BackgroundAugmenter from imgaug.multicore
Downstream training, inference, and data preprocessing workflows that depend on imgaug

Discovery Timeline

2026-05-12 - CVE-2026-31235 published to the National Vulnerability Database
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-31235

Vulnerability Analysis

The imgaug library provides image augmentation primitives commonly used in computer vision training pipelines. The BackgroundAugmenter class accelerates augmentation by distributing work across multiple processes using Python's multiprocessing.Queue. Worker processes consume serialized batches from this queue and apply augmentation operations.

The _augment_images_worker() method in multicore.py retrieves messages from the queue and reconstructs Python objects using pickle. The pickle module is documented as unsafe for untrusted input because it can execute arbitrary callables via the __reduce__ protocol during deserialization. The vulnerable code path performs no signing, no sandboxing, and no class allow-listing before invoking deserialization.

The issue maps to CWE-502, Deserialization of Untrusted Data.

Root Cause

The root cause is the unconditional use of pickle.loads (or equivalent) on data received from a multiprocessing queue without authenticating the producer or validating the payload. Python's pickle format treats serialized data as executable instructions, so any attacker-controlled bytes that reach the deserializer can hijack execution.

Attack Vector

Exploitation requires the attacker to influence the data placed onto the queue consumed by BackgroundAugmenter workers. Practical paths include a compromised producer process, a shared queue exposed across trust boundaries, a malicious training script imported into a victim project, or social engineering that causes a developer to load a tampered dataset loader. Once a malicious pickle payload is dequeued, the worker process executes attacker-supplied code with the privileges of the training or inference user.

No verified exploit code is published in the referenced advisories. Refer to the imgaug source repository for the affected multicore.py implementation.

Detection Methods for CVE-2026-31235

Indicators of Compromise

Unexpected child processes spawned from Python worker processes that import imgaug.multicore
Outbound network connections originating from data augmentation or training worker processes
Write activity to sensitive paths (for example ~/.ssh, cron directories) from Python ML workloads
Anomalous shell interpreters (sh, bash, cmd.exe) launched as children of Python multiprocessing workers

Detection Strategies

Inventory Python environments for imgaug<=0.4.0 using software composition analysis or pip list audits
Hunt for process lineage where Python workers spawn interpreters, compilers, or network clients
Inspect training pipelines and data loaders for untrusted producers feeding BackgroundAugmenter queues
Apply YARA or signature rules that flag pickle opcodes (c__builtin__\nexec, cposix\nsystem, R) inside serialized artifacts on disk

Monitoring Recommendations

Forward Python process telemetry, command-line arguments, and child process events to a centralized data lake for retrospective hunting
Alert on Python processes initiating outbound connections to non-allowlisted destinations
Correlate file write events to credential and persistence locations with active ML training jobs

How to Mitigate CVE-2026-31235

Immediate Actions Required

Identify every host, container, and notebook environment that ships imgaug 0.4.0 or earlier
Restrict BackgroundAugmenter usage to trusted, locally produced data until a fixed release is deployed
Treat multiprocessing queues as trust boundaries and isolate producers and consumers within the same security context
Run ML training workloads under least-privilege service accounts with no interactive shell and no outbound internet access by default

Patch Information

At the time of NVD publication, no fixed upstream release is listed in the advisory. Track the imgaug GitHub repository for an updated version that replaces pickle with a safe serialization format or adds payload authentication. Until then, pin builds to vetted commits and rebuild affected container images once a patched version is available.

Workarounds

Replace BackgroundAugmenter with a single-process augmentation path or an alternative library that does not deserialize untrusted pickle data
Wrap queue messages with HMAC authentication so worker processes reject payloads that lack a valid signature before invoking pickle
Patch multicore.py locally to substitute pickle with a restricted unpickler that allow-lists only expected NumPy and imgaug classes
Execute training workers inside containers or sandboxes with seccomp, AppArmor, or SELinux profiles that block execve of unexpected binaries

bash

# Configuration example: audit and remove vulnerable imgaug installs
pip show imgaug | grep -E '^(Name|Version|Location):'
pip uninstall -y imgaug
# Reinstall only after a patched upstream release is published
# pip install 'imgaug>X.Y.Z'