Treeio up to and including version 2.0 contains an insecure deserialization flaw that permits staff users to execute arbitrary Python code when the web application renders news feeds. The vulnerability originates from the UpdateRecord.get_format_strings and ModuleSetting.loads functions, which accept pickle data without validating or sanitizing it. If an attacker fabricates a base64‑encoded pickle payload and stores it in the UpdateRecord.format_strings field via the Django admin, the payload is later deserialized and executed as the web server user, compromising the entire site. This flaw falls under the CWE‑502 category of insecure deserialization and can lead to full control of the affected system.

The affected product is Treeio, as distributed by the Treeio organization. All releases from the initial release through version 2.0 are vulnerable, as indicated by the “through 2.0” statement in the advisory. No specific sub‑version ranges are listed beyond this cutoff point.

The issue has a CVSS score of 8.6, classifying it as high severity. No EPSS score is available, but the vulnerability is not listed in the CISA KEV catalog, suggesting that publicly documented exploitation is limited as of now. The likely attack vector requires authenticated staff access to the Django admin interface to inject the malicious pickle payload; once the payload is stored, it is executed in the context of the web server user whenever news feeds are rendered. Because the flaw allows code execution, the attack surface is significant, especially for organizations that enable or expose the admin interface to users beyond a narrow set of trusted staff.