PT-2026-53379 · Pypi · Apscheduler

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling setstate on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers

Fix

Related Identifiers

PYSEC-2026-282

Affected Products

Apscheduler

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-31072 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-282 · Vendor Advisory
• https://github.com/agronholm/apscheduler · Note
• https://github.com/advisories/GHSA-9cfw-f3f9-7mm7 · Note
• https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6 · Note
• https://pypi.org/project/apscheduler · Note