Executive brief
PyOD is a Python library for anomaly detection that includes functionality to save and load trained models. The load function deserializes model files before validating whether they are legitimate PyOD model files, allowing an attacker to execute arbitrary code when a user loads a malicious model file. This is particularly dangerous in machine learning platforms, automated evaluation systems, and CI/CD pipelines that import external model artifacts.
Technical details
The vulnerability is a deserialization of untrusted data issue (CWE-502) in pyod.utils.persistence.load(). The root cause is improper validation order: the function calls joblib.load(path) immediately, which triggers pickle deserialization and can execute Python reducers embedded in the artifact, before _is_envelope() and schema validation checks run. This means strict=True mode and envelope validation cannot prevent malicious code execution. An attacker who controls a model artifact that a victim application loads can execute arbitrary Python code with the privileges of the loading process. No authentication or user interaction is required beyond the victim calling load() on an attacker-controlled file. The fix (released in version 3.6.2) reorders validation to check the envelope metadata before full deserialization. This vulnerability has a CVSS v3.1 score of 6.3 (Network/Low complexity/Low privileges required).
Affected products
- yzhao062 PyOD >=3.5.0, <3.6.2
Timeline
- 2026-06-10: disclosed: Vulnerability reported in issue #697
- 2026-07-13: advisory: Published in GitHub Advisory Database and NVD as CVE-2026-15529
- 2026-07-20: patched: Fix merged in PR #698; version 3.6.2 released with patch