PyMoDAQ and its component modules allow attackers to execute arbitrary code by delivering specially crafted files that trigger unsafe deserialization and eval operations. Deserialization of pickled objects in HDF5 string nodes, evaluation of Python expressions in HDF5 attributes, loading of .dock layout files, and evaluation of Python code embedded in XML settings files expose the application to arbitrary code execution. The weakness is classified as CWE-502 (Deserialization of Untrusted Data) and CWE-95 (Eval Injection). An attacker who can supply such files, or trick a user into loading them, can run any code on the host system, compromising confidentiality, integrity, and availability.

PyMoDAQ packages and its dependencies—including PyMoDAQ, pymodaq_data, pymodaq_gui, and pymodaq_utils—are affected. Versions prior to 4.4.13, before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10 contain the vulnerability. Users running any of these versions are at risk until updated.

The CVSS score of 8.5 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to deliver malicious HDF5, .dock, or XML settings files that an authenticated or local user opens. Once a file is processed, the exploitation bypasses authentication and runs code with the privileges of the application user. The high impact combined with the requirement for file access makes it a significant risk for installations that accept or process user-supplied files.