GHSA-g82g-j283-hj97

Suggest an improvement
Source
https://github.com/advisories/GHSA-g82g-j283-hj97
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-g82g-j283-hj97/GHSA-g82g-j283-hj97.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g82g-j283-hj97
Aliases
Published
2026-05-12T18:30:41Z
Modified
2026-06-29T12:26:38Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module
Details

The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py module. The class uses Python's pickle module to deserialize data received via a multiprocessing queue in the _augment_images_worker() method without any safety checks. An attacker who can influence the data placed into this queue (e.g., through social engineering, malicious input scripts, or a compromised shared queue) can provide a malicious pickle payload. When deserialized, this payload can execute arbitrary code in the context of the worker process, leading to remote or local code execution depending on the deployment scenario.

Database specific 
{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-27T22:25:43Z",
    "nvd_published_at":  "2026-05-12T18:16:51Z",
    "severity":  "CRITICAL"
}
References

Affected packages

PyPI / imgaug

Package

Name
imgaug
View open source insights on deps.dev
Purl
pkg:pypi/imgaug

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.4.0

Affected versions

0.*
0.2.0
0.2.1
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.3.0
0.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-g82g-j283-hj97/GHSA-g82g-j283-hj97.json"