CVE-2026-124318

Description

Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: HIGH
CVSS score: 8.6 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Effective score: 8.6 / 10 HIGH source: CNA overview
CWE(s): CWE-502
Reserved: 2026-11-07
Published: 2026-11-07 14:17 UTC
Last updated: 2026-11-07 14:17 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124318.json
Linked Threat: CVE-2026-124318 — Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119272
Assigner: VulnCheck
Published: Nov 7, 2026, 2:17:57 PM
Updated: Nov 7, 2026, 2:17:57 PM
EUVD base score (CVSS 4.0): 8.6 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: treeio
Products: treeio (0 ≤2.0)
Aliases: GHSA-3rqm-3mpx-jvr5

ENISA description: Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.

EUVD references (5)

Affected products (1)

Vendor	Product	Versions	Platforms
treeio	treeio	`0` (affected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

https://github.com/treeio/treeio/issues/165 issue-tracking
https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1101-L1109 technical-description
https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1265-L1273 technical-description
https://github.com/treeio/treeio product
VulnCheck Advisory: Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields third-party-advisory

MITRE references (5) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/treeio/treeio product
https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1101-L1109 technical-description
https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1265-L1273 technical-description
https://github.com/treeio/treeio/issues/165 issue-tracking
VulnCheck Advisory: Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft Patch Tuesday, October 2026 Security Update Review

web:blog.qualys.com

Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services.

2026-11-08 10:20 UTC
CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-08 10:20 UTC
September 2026 Patch Tuesday — Complete CVE Reference

web:endpointweekly.com

All 633 CVEs from September 2026 Patch Tuesday — searchable, filterable, with plain-English IT admin notes on every vulnerability. Includes CVE - 2026 -81963, the exploited Windows Update Stack EoP, and the five CVEs KB5124008 does not fix .

2026-11-08 10:20 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort ...

2026-11-08 10:20 UTC
SSHole: High-Severity OpenSSH Vulnerability Turns Disabled Passwords ...

web:safe.security

By SAFE Threat Research Team Overview An account with no valid password should never accept password authentication. A newly disclosed OpenSSH vulnerability breaks that fundamental security assumption, potentially allowing attackers to gain unauthorized access to Linux systems and, in certain configurations, achieve full root compromise. Disclosed on November 5, 2026 , SSHole ( CVE - 2026 -123158 ...

2026-11-08 10:20 UTC
Microsoft Patch Tracker (November 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-11-08 10:20 UTC
SAP Security Patch Day - October 2026

web:support.sap.com

On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.

2026-11-08 10:20 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.

2026-11-08 10:20 UTC
The 8 Best Automated Vulnerability Remediation Tools in 2026

web:www.openhands.dev

Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.

2026-11-08 10:20 UTC
CVE-2026-124318: UpdateRecord Insecure Deserialization - Analysis & Fix ...

web:www.thehackerwire.com

How do I fix or mitigate CVE-2026-124318 ? To protect against CVE-2026-124318 , you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-11-08 10:20 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-124318.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/treeio/treeio",
          "product": "treeio",
          "repo": "https://github.com/treeio/treeio",
          "vendor": "treeio",
          "versions": [
            {
              "lessThanOrEqual": "2.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MJ DHURGESH"
        }
      ],
      "datePublic": "2026-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T14:17:57.859Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/treeio/treeio/issues/165"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1101-L1109"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1265-L1273"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/treeio/treeio"
        },
        {
          "name": "VulnCheck Advisory: Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124318",
    "datePublished": "2026-11-07T14:17:57.859Z",
    "dateReserved": "2026-11-07T12:27:51.208Z",
    "dateUpdated": "2026-11-07T14:17:57.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}