Answer in brief
CVE-2026-120859 records a High severity (CVSS 8.5) vulnerability in PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files. The current sources do not mark it as known exploited. The current feed maps PyMoDAQ/PyMoDAQ (generic), PyMoDAQ/pymodaq_data (generic), PyMoDAQ/pymodaq_gui (generic), PyMoDAQ/pymodaq_utils (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps PyMoDAQ/PyMoDAQ (generic), PyMoDAQ/pymodaq_data (generic), PyMoDAQ/pymodaq_gui (generic), PyMoDAQ/pymodaq_utils (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| PyMoDAQ/PyMoDAQgeneric | >=0 <4.4.13 | 4.4.13 |
| PyMoDAQ/pymodaq_datageneric | >=0 <5.1.15 || >=5.2.0 <5.2.14 || >=5.3.0 <5.3.10 | 5.1.15, 5.2.14, 5.3.10 |
| PyMoDAQ/pymodaq_guigeneric | >=0 <5.1.15 || >=5.2.0 <5.2.14 || >=5.3.0 <5.3.10 | 5.1.15, 5.2.14, 5.3.10 |
| PyMoDAQ/pymodaq_utilsgeneric | >=0 <5.1.15 || >=5.2.0 <5.2.14 || >=5.3.0 <5.3.10 | 5.1.15, 5.2.14, 5.3.10 |
Published upstream
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate.
Quoted source text, attributed separately from HOL analysis.