CVE-2026-15529: PyOD persistence.load deserializes untrusted artifacts before validation
(updated )
A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix this issue requires some minor changes.
References
- github.com/advisories/GHSA-997v-r4v7-9f3g
- github.com/yzhao062/pyod
- github.com/yzhao062/pyod/commit/16e6e3ad8921a4e18ccc8c2afe474db7d002c001
- github.com/yzhao062/pyod/issues/697
- github.com/yzhao062/pyod/pull/698
- github.com/yzhao062/pyod/releases/tag/v3.6.2
- nvd.nist.gov/vuln/detail/CVE-2026-15529
- pypi.org/project/pyod/3.6.2
- vuldb.com/cve/CVE-2026-15529
- vuldb.com/submit/854559
- vuldb.com/vuln/377872
- vuldb.com/vuln/377872/cti
Code Behaviors & Features
Detect and mitigate CVE-2026-15529 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →