CVE-2026-2970: datapizza-ai Unsafe Deserialization Vulnerability in RedisCache
Summary
CVE-2026-2970: datapizza-ai has unsafe deserialization via pickle.loads() in RedisCache. Affects datapizza-ai-core versions < 0.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
datapizza-ai is a Python package developed by datapizza-labs, designed to facilitate AI-driven data processing and caching mechanisms. The package includes a RedisCache component that allows for efficient data storage and retrieval using Redis. However, the version 0.0.7 of this package has been found to have a critical vulnerability related to unsafe deserialization, which can expose systems to potential attacks if exploited.
Vulnerability Detail
The vulnerability arises from the use of the pickle.loads() function in the RedisCache implementation within the datapizza-ai package. This function is susceptible to deserialization attacks, allowing an attacker on the local network to manipulate data and execute arbitrary code. The complexity of the attack is high, making exploitation challenging, but the potential ramifications include unauthorized access and data manipulation, which could compromise the integrity and security of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling the RedisCache functionality or implementing strict input validation to prevent untrusted data from being deserialized. This can help mitigate the risk until a patch is applied.
Conclusion
The datapizza-ai package version 0.0.7 contains a vulnerability related to unsafe deserialization in its RedisCache component. Users are advised to update to a patched version or implement workarounds to mitigate potential risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for datapizza-ai-core →
FAQ
The vulnerability is related to unsafe deserialization via the pickle.loads() function, which can lead to potential code execution if exploited.
Users of the datapizza-ai package version 0.0.7 are affected, particularly those utilizing the RedisCache component.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling the RedisCache functionality or implementing strict input validation as a temporary measure.
The CVSS score of this vulnerability is 4.6, indicating a moderate level of risk associated with its exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for datapizza-ai-core.
