PT-2026-40122 · Pypi · Imgaug

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-31235

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions imgaug versions prior to 0.4.0

Description Insecure deserialization occurs in the BackgroundAugmenter class within the multicore.py module. The augment images worker() function uses Python's pickle module to deserialize data from a multiprocessing queue without safety checks. An attacker capable of influencing the queue data can provide a malicious pickle payload, which, upon deserialization, allows for arbitrary code execution in the context of the worker process.

Recommendations Update to a version later than 0.4.0. As a temporary workaround, restrict access to the BackgroundAugmenter class or the augment images worker() function to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-31235

GHSA-G82G-J283-HJ97

Affected Products

Imgaug

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-31235 · Security Note
• https://osv.dev/vulnerability/GHSA-g82g-j283-hj97 · Vendor Advisory
• https://github.com/aleju/imgaug · Note
• https://notion.so/CVE-2026-31235-35d1e139318881efb701d814228424a9 · Note