CVE-2026-31220

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31220
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31220.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-31220
Aliases
Published
2026-05-12T00:00:00Z
Modified
2026-10-21T02:30:21Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxing of user-submitted code. The system allows low-privileged users to submit Python functions (via @sy.syft_function()) for remote execution on the server. While a code approval mechanism exists, the submitted code undergoes no security checks for dangerous operations (e.g., file access, command execution). Once approved, the code is executed within the server process using exec() and eval() functions without proper isolation. A remote attacker can leverage this to execute arbitrary Python code on the server, leading to complete compromise of the server environment.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31220.json"
}
References

Affected packages

Git / github.com/openmined/pysyft

Affected ranges

Type
GIT
Repo
https://github.com/openmined/pysyft
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
2a527bb473d9c8295c234c1c9e098a21bdb3e88b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.9.5"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*
0.6.0
syftcli-v0.*
syftcli-v0.1.6
syftcli-v0.1.7
v0.*
v0.8.0
v0.8.1
v0.8.2
v0.8.2b19
v0.8.2b20
v0.8.2b21
v0.8.2b22
v0.8.2b23
v0.8.2b24
v0.8.2b25
v0.8.2b26
v0.8.2b27
v0.8.2b28
v0.8.2b29
v0.8.2b30
v0.8.2b31
v0.8.2b32
v0.8.2b33
v0.8.2b34
v0.8.2b35
v0.8.2b36
v0.8.2b37
v0.8.2b38
v0.8.2b39
v0.8.2b40
v0.8.2b41
v0.8.2b42
v0.8.2b43
v0.8.2b44
v0.8.2b45
v0.8.2b46
v0.8.2b47
v0.8.2b48
v0.8.2b49
v0.8.2b50
v0.8.2b51
v0.8.2b52
v0.8.2b53
v0.8.2b54
v0.8.2b55
v0.8.2b56
v0.8.2b57
v0.8.2b58
v0.8.2b59
v0.8.2b60
v0.8.3
v0.8.3b1
v0.8.3b2
v0.8.3b3
v0.8.3b4
v0.8.3b5
v0.8.3b6
v0.8.4
v0.8.4b1
v0.8.4b10
v0.8.4b11
v0.8.4b12
v0.8.4b13
v0.8.4b14
v0.8.4b15
v0.8.4b16
v0.8.4b18
v0.8.4b19
v0.8.4b2
v0.8.4b20
v0.8.4b21
v0.8.4b22
v0.8.4b23
v0.8.4b24
v0.8.4b25
v0.8.4b26
v0.8.4b27
v0.8.4b28
v0.8.4b29
v0.8.4b3
v0.8.4b30
v0.8.4b31
v0.8.4b4
v0.8.4b6
v0.8.4b7
v0.8.4b8
v0.8.4b9
v0.8.5
v0.8.5-post.1
v0.8.5-post.2
v0.8.5b1
v0.8.5b10
v0.8.5b2
v0.8.5b3
v0.8.5b4
v0.8.5b5
v0.8.5b6
v0.8.5b8
v0.8.5b9
v0.8.6
v0.8.6b1
v0.8.7
v0.8.7b1
v0.8.7b10
v0.8.7b12
v0.8.7b13
v0.8.7b14
v0.8.7b15
v0.8.7b16
v0.8.7b2
v0.8.7b3
v0.8.7b4
v0.8.7b5
v0.8.7b6
v0.8.7b7
v0.8.7b9
v0.8.8
v0.8.8b1
v0.8.8b2
v0.8.8b4
v0.9.0
v0.9.0b1
v0.9.0b2
v0.9.0b3
v0.9.0b4
v0.9.0b5
v0.9.1
v0.9.1b1
v0.9.1b10
v0.9.1b11
v0.9.1b2
v0.9.1b3
v0.9.1b4
v0.9.1b5
v0.9.1b6
v0.9.1b7
v0.9.1b8
v0.9.1b9
v0.9.2
v0.9.2b1
v0.9.2b2
v0.9.2b3
v0.9.2b4
v0.9.2b5
v0.9.2b6
v0.9.2b7
v0.9.2b8
v0.9.3
v0.9.3b1
v0.9.3b2
v0.9.3b4
v0.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31220.json"