---
id: "CVE-2026-31235"
kind: "vulnerability"
aliases: ["CVE-2026-31235", "GHSA-g82g-j283-hj97"]
title: "imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module"
severity: "critical"
cvss: 9.8
epss: 0.00473
exploited: false
status: "open"
category: "package"
products: [{"name": "imgaug", "fixed": [], "affected": "<= 0.4.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-502", "data-pipelines", "imgaug", "machine-learning", "package", "python"]
not_affected_if: ["no-background-augmenter", "queue-not-shared"]
published_at: "2026-05-12T18:16:51+00:00"
first_seen_at: "2026-10-27T17:22:22+00:00"
updated_at: "2026-10-27T17:32:47+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-g82g-j283-hj97", "first_seen_at": "2026-10-27T17:22:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31235", "first_seen_at": "2026-10-27T17:32:47+00:00"}]
---

# imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module

The imgaug Python library's BackgroundAugmenter unpickles data from a multiprocessing queue without checks, so a crafted pickle payload runs code in the worker process. An attacker who can write to that queue gets code execution as the worker, which the sources describe as remote or local depending on deployment.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:imgaug affected <= 0.4.0 fixed ?

## How to check

- `pip show imgaug` to read the installed version; affected is `<= 0.4.0`
- Search your code for `BackgroundAugmenter` imports from `imgaug.multicore`, which is the vulnerable path

## Timeline

- 2026-10-27T17:22:22+00:00 ghsa https://github.com/advisories/GHSA-g82g-j283-hj97
- 2026-10-27T17:32:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-31235

## From the sources

The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py module. The class uses Python's pickle module to deserialize data received via a multiprocessing queue in the _augment_images_worker() method without any safety checks. An attacker who can influence the data placed into this queue (e.g., through social engineering, malicious input scripts, or a compromised shared queue) can provide a malicious pickle payload. When deserialized, this payload can execute arbitrary code in the context of the worker process, leading to remote or local code execution depending on the deployment scenario.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_