{"id":"CVE-2026-31235","kind":"vulnerability","aliases":["CVE-2026-31235","GHSA-g82g-j283-hj97"],"related":[],"title":"imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module","description":"The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py module. The class uses Python's pickle module to deserialize data received via a multiprocessing queue in the _augment_images_worker() method without any safety checks. An attacker who can influence the data placed into this queue (e.g., through social engineering, malicious input scripts, or a compromised shared queue) can provide a malicious pickle payload. When deserialized, this payload can execute arbitrary code in the context of the worker process, leading to remote or local code execution depending on the deployment scenario.","summary":"The imgaug Python library's BackgroundAugmenter unpickles data from a multiprocessing queue without checks, so a crafted pickle payload runs code in the worker process. An attacker who can write to that queue gets code execution as the worker, which the sources describe as remote or local depending on deployment.","severity":"critical","cvss":9.8,"epss":0.00473,"exploited":false,"exploited_at":null,"products":[{"name":"imgaug","fixed":[],"affected":"<= 0.4.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-502","data-pipelines","imgaug","machine-learning","package","python"],"not_affected_if":["no-background-augmenter","queue-not-shared"],"how_to_check":"- `pip show imgaug` to read the installed version; affected is `<= 0.4.0`\n- Search your code for `BackgroundAugmenter` imports from `imgaug.multicore`, which is the vulnerable path","fix":null,"status":"open","published_at":"2026-05-12T18:16:51+00:00","first_seen_at":"2026-10-27T17:22:22+00:00","triaged_at":"2026-10-27T17:23:42+00:00","updated_at":"2026-10-27T17:32:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T17:23:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"imgaug: pickle deserialization in BackgroundAugmenter lets queue data run code","impact":"high","summary":"The imgaug Python library's BackgroundAugmenter unpickles data from a multiprocessing queue without checks, so a crafted pickle payload runs code in the worker process. An attacker who can write to that queue gets code execution as the worker, which the sources describe as remote or local depending on deployment.","category":"package","nicknames":[],"who_cares":["python","imgaug","machine-learning","data-pipelines"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code in the augmentation worker process","analyst_note":"Find a fixed version or upgrade guidance in GHSA-g82g-j283-hj97 (https://github.com/advisories/GHSA-g82g-j283-hj97); sources list no fixed version.","how_to_check":"- `pip show imgaug` to read the installed version; affected is `<= 0.4.0`\n- Search your code for `BackgroundAugmenter` imports from `imgaug.multicore`, which is the vulnerable path","needs_analyst":true,"not_affected_if":["no-background-augmenter","queue-not-shared"],"who_is_affected":"Only projects that use imgaug's BackgroundAugmenter (imgaug.multicore) with a multiprocessing queue that other parties or untrusted processes can write to. Code that runs imgaug single-process or only with data it fully controls is less exposed, but the sources do not say how far that reduces risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00064,"input_tokens":3472,"output_tokens":586,"severity_before":"critical"},"analyst_status":"queued","analyst_note":"Find a fixed version or upgrade guidance in GHSA-g82g-j283-hj97 (https://github.com/advisories/GHSA-g82g-j283-hj97); sources list no fixed version.","search":"'-2026':14A,22A '-31235':15A,23A '-502':26B '0.4.0':90C 'arbitrari':164C 'attack':62B,130C 'augment':121C 'backgroundaugment':8A,41B,98C 'check':49B,128C 'class':9A,99C,105C 'code':56B,70B,165C,178C 'compromis':149C 'contain':2A,91C 'context':168C 'craft':52B 'cve':13A,21A 'cwe':25B 'data':28B,43B,113C,135C 'data-pipelin':27B 'depend':83B,180C 'deploy':85B,183C 'describ':78B 'deseri':5A,94C,112C,159C 'e.g':140C 'engin':143C 'execut':71B,163C,179C 'g82g':18A 'get':69B 'ghsa':17A 'ghsa-g82g-j283-hj97':16A 'hj97':20A 'imag':122C 'imgaug':1A,24A,30B,37B,87C 'influenc':133C 'input':145C 'insecur':4A,93C 'j283':19A 'lead':173C 'learn':33B 'librari':39B,88C 'local':82B,177C 'machin':32B 'machine-learn':31B 'malici':144C,155C 'method':124C 'modul':12A,103C,110C 'multicore.py':11A,102C 'multiprocess':46B,117C 'packag':34B 'payload':54B,157C,161C 'pickl':53B,109C,156C 'pipelin':29B 'place':136C 'process':60B,172C 'provid':153C 'python':35B,38B,107C 'queue':47B,68B,118C,139C,151C 'receiv':114C 'remot':80B,175C 'run':55B 'safeti':127C 'scenario':184C 'script':146C 'share':150C 'social':142C 'sourc':77B 'thru':89C 'unpickl':42B 'use':106C 'via':115C 'vulner':6A,95C 'within':10A,100C 'without':48B,125C 'worker':59B,74B,123C,171C 'write':65B","nicknames":[],"mitigations":[],"who_affected":"Only projects that use imgaug's BackgroundAugmenter (imgaug.multicore) with a multiprocessing queue that other parties or untrusted processes can write to. Code that runs imgaug single-process or only with data it fully controls is less exposed, but the sources do not say how far that reduces risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-12T18:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-g82g-j283-hj97","url":"https://github.com/advisories/GHSA-g82g-j283-hj97","severity":"critical","published_at":"2026-05-12T18:30:41+00:00","modified_at":"2026-10-27T17:17:36+00:00","first_seen_at":"2026-10-27T17:22:22+00:00","fetched_at":"2026-10-27T17:22:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-31235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31235","severity":null,"published_at":"2026-05-12T18:16:51+00:00","modified_at":"2026-06-17T10:33:29+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}