CVE-2026-15529 yzhao062 CVE debrief

Who should care

Users of yzhao062 pyod 3.5.0/3.5.1/3.5.2, security teams, and vulnerability management teams should review and apply the provided patch to prevent potential deserialization attacks. They should assess the impact on their environments, inventory and update affected pyod versions, and monitor for potential deserialization attacks.

Technical summary

The vulnerability exists in the pyod.utils.persistence.load function within the pyod/utils/persistence.py file of the pyod package. This function is susceptible to deserialization attacks when the path argument is manipulated. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Affected product deployments should be reviewed for exposure. Users should confirm whether affected product deployments exist in managed environments and review compensating controls for exposed systems.

Defensive priority

Apply the patch to prevent deserialization attacks, review affected product deployments, and confirm whether affected product deployments exist in managed environments. Track exceptions and retest remediated assets.

Recommended defensive actions

• Review and apply the provided patch
• Inventory and update affected pyod versions
• Monitor for potential deserialization attacks
• Confirm whether affected product deployments exist in managed environments
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-07-13T04:16:28.577Z and has not been modified since then. The NVD entry is currently Received. Evidence is limited to CVE and NVD details. Defenders should verify affected product deployments, review official advisories, and check relevant monitoring, detection, and logs for exposed assets. Additional review is recommended to validate affected scope, severity, and vendor guidance.

Official resources