PT-2026-36304 · Labone Q · Labone Q

Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-7584

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LabOne Q (affected versions not specified)

Description The serialization framework uses a class-loading mechanism import cls() to dynamically import and instantiate Python classes during deserialization. The mechanism accepts arbitrary fully-qualified class names from serialized data without validating the target class or restricting the modules that can be imported. This allows an attacker to craft a serialized experiment file that forces the deserialization engine to import and instantiate arbitrary Python classes with controlled constructor arguments, leading to arbitrary code execution in the context of the user running the Python process. This occurs when a victim loads a malicious file, such as a compromised experiment file shared for collaboration or support.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-7584

Affected Products

Labone Q

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7584 · Security Note
• https://zhinst.com/support/security/2026/zi-sa-2026-002 · Vendor Advisory
• https://twitter.com/CVEnew/status/2050144025290883451 · Twitter Post
• https://t.me/CVEtracker/52395 · Telegram Post
• https://t.me/cveNotify/161698 · Telegram Post