Is CVE-2024-53305 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-53305 being exploited in the wild.

How severe is CVE-2024-53305?

Medium severity, with a CVSS score of 4, published 7 July 2026.

Which products and versions are affected?

whoogle-search (PyPI) ECOSYSTEM:introduced=0,fixed=0.9.1.

Is there a fix for CVE-2024-53305?

Yes. whoogle-search (PyPI): upgrade to 0.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-53305 attacked?

It is attacked over the network.

Am I affected by CVE-2024-53305?

Check whether you run whoogle-search (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-53305: PYSEC-2026-2048 - Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

CVE-2024-53305 · Severity: medium · CVSS 4 · Published 2026-07-07

Whoogle is a privacy-focused search engine metasearch application. An attacker can execute arbitrary code on the server by submitting a specially crafted search query that exploits insecure deserialization in the configuration handling. This could allow complete compromise of the Whoogle instance, including access to user data and the ability to modify search results.

Technologies: whoogle-search (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-53305 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-53305 being exploited in the wild.
How severe is CVE-2024-53305?: Medium severity, with a CVSS score of 4, published 7 July 2026.
Which products and versions are affected?: whoogle-search (PyPI) ECOSYSTEM:introduced=0,fixed=0.9.1.
Is there a fix for CVE-2024-53305?: Yes. whoogle-search (PyPI): upgrade to 0.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-53305 attacked?: It is attacked over the network.
Am I affected by CVE-2024-53305?: Check whether you run whoogle-search (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

whoogle-search (PyPI): upgrade to 0.9.1 or later
```
pip install "whoogle-search>=0.9.1"
```

Technical details

Whoogle v0.9.0 and earlier versions contain a remote code execution vulnerability in the /models/config.py component caused by the use of Python's insecure pickle.loads() function for deserializing configuration data. An unauthenticated remote attacker can supply a malicious search query containing crafted pickle payloads that trigger arbitrary code execution on the server. The vulnerability requires no authentication or user interaction beyond submitting the search query. The fix, released in version 0.9.1, replaces pickle serialization with JSON, which is safe by design.

Affected products

Whoogle whoogle-search 0.1.0 through 0.9.0

Identifiers

CVE-2024-53305
GHSA-2689-cw26-6cpj
PYSEC-2026-2048

Timeline

2025-04-16: disclosed
2025-04-16: patched: Fixed in version 0.9.1

References

https://github.com/benbusby/whoogle-search/commit/223f00c3c0533423114f99b30c561278bc0b42ba

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.