CVE-2026-2970
Medium · 4.6CVSS
4.6
EPSS
1.2%
Published
Feb 23, 2026
CISA due date
—
The record
A vulnerability has been found in datapizza-labs datapizza-ai 0.0.2. Affected by this vulnerability is the function RedisCache of the file datapizza-ai-cache/redis/datapizza/cache/redis/cache.py. Such manipulation leads to deserialization. The attack requires being on the local network. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | datapizza-ai-core | 0 | No fix |
Related vulnerabilities
- GHSA-hg58-x52p-859c datapizza-ai has unsafe deserialization via pickle.loads() in RedisCache Same vulnerability
- GHSA-q5xx-fxv3-xxqf datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template… Also affects datapizza-ai-core
- CVE-2026-2969 A flaw has been found in datapizza-labs datapizza-ai 0.0.2. Also affects datapizza-ai-core
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20
- CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved: ipv4: validate… CWE-20