Description
A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx of the component trie File Handler. The manipulation results in deserialization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-04-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A flaw in pytries datrie (up to version 0.8.3) in the Trie.__setstate__ routine allows an attacker to provide a crafted serialized payload that is processed during deserialization. The vulnerability aligns with CWE‑20 (Improper Input Validation) and CWE‑502 (Deserialization of Untrusted Data). If an application loads a trie from external input, an attacker could exploit this flaw to execute arbitrary code or otherwise compromise the system, impacting confidentiality, integrity, and availability.

Affected Systems

The affected product is the pytries datrie library, versions up to 0.8.3. The library is hosted on GitHub and used in Python projects that rely on trie functionality. No specific sub‑versions are listed beyond the 0.8.3 cutoff.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate overall damage potential, but the lack of a patch means the vulnerability remains exploitable. Public exploit code is available, and the attack can be launched remotely by supplying malicious data to an application that deserializes using Trie.__setstate__. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, yet the remote nature and deserialization weakness make it a serious risk for vulnerable deployments.

Generated by OpenCVE AI on April 6, 2026 at 16:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the pytries datrie library to the latest available release that contains the deserialization fix. If no newer release exists, remove or replace the dependency with an alternative implementation. Ensure that any data deserialized through Trie.__setstate__ comes only from trusted sources, and validate or sanitize such input before loading.

Generated by OpenCVE AI on April 6, 2026 at 16:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Pytries
Pytries datrie
Vendors & Products Pytries
Pytries datrie

Mon, 06 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx of the component trie File Handler. The manipulation results in deserialization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title pytries datrie trie File datrie.pyx Trie.__setstate__ deserialization
Weaknesses CWE-20
CWE-502
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Pytries Datrie
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T14:49:10.387Z

Reserved: 2026-04-06T07:35:11.413Z

Link: CVE-2026-5659

cve-icon Vulnrichment

Updated: 2026-04-06T14:46:25.826Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-06T14:16:26.150

Modified: 2026-04-07T13:20:35.010

Link: CVE-2026-5659

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:32:48Z

Weaknesses