Executive brief
APScheduler is a popular Python library used for scheduling tasks and background jobs. A security flaw in its data processing components allows an attacker to execute malicious code on the server by sending specially crafted data. This could lead to a complete system takeover, unauthorized data access, or disruption of scheduled business operations.
Technical details
The vulnerability exists in the JSONSerializer and CBORSerializer components of APScheduler, specifically within the unmarshal_object function. This function processes a 'magic key' (e.g., _apscheduler_json) that triggers dynamic module importing and class instantiation via cls.__new__(cls). It then calls __setstate__ on the resulting instance using attacker-controlled data. Because the function does not restrict which classes can be instantiated, an attacker can leverage available Python gadgets to achieve arbitrary code execution. The issue affects the 4.x alpha release line where these serializers were introduced; the 3.x stable line is reportedly not affected.
Affected products
- Alex Grönholm APScheduler >= 4.0.0a1, <= 4.0.0a6
Timeline
- 2026-05-19: disclosed: Initial disclosure and NVD publication
- 2026-05-19: advisory: GitHub Advisory published