CVE-2026-124318

Description

Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/treeio/treeio/issues/165 ↗
• https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1101-L1109 ↗
• https://github.com/treeio/treeio/blob/bae3115f4015aad2cbc5ab45572232ceec990495/treeio/core/models.py#L1265-L1273 ↗
• https://github.com/treeio/treeio ↗
• https://www.vulncheck.com/advisories/treeio-through-2.0-insecure-deserialization-rce-via-admin-editable-pickle-fields ↗