{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"treeio/treeio","product":"treeio","source":"CNA: VulnCheck","vendor":"treeio","versions":[{"lessThanOrEqual":"2.0","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-124318","cwes":["CWE-502"],"description":"Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.2,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794061077859,"publishedAt":1794061077859,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/treeio/treeio/issues/165"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1101-L1109"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1265-L1273"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/treeio/treeio"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields"}],"remediation":[],"revision":"8a7a18480d9d312f949158151f1ca4513795bfc9019f12877dbbcc25aaef7baa","sources":[{"modifiedAt":1794061077859,"name":"CNA: VulnCheck","retrievedAt":1794064147380,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124318"}],"ssvc":null,"status":"published","title":"Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields","updatedAt":1794064147380}