CVE-2026-31072
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
APScheduler in all versions (including 3.10.x and 4.0.0a5) is vulnerable to Remote Code Execution (RCE) via insecure deserialization in JSONSerializer and CBORSerializer. The unmarshal_object function allows arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any available Python class.
Risk Assessment
An attacker can submit a specially crafted JSON or CBOR payload to an application using these serializers, potentially leading to remote code execution and full server compromise.
Recommendation
Immediately upgrade APScheduler to a patched version or use alternative serializers that are not vulnerable to insecure deserialization.
Original NVD description (English source)
The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers