{"id":"CVE-2026-102739","title":"ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution","summary":"ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with Nu…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-502"],"vendor":"francescopace","product":"espectre","affected":["espectre < 3.0.0-rc1"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T16:09:12.295Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102739","references":[{"url":"https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3","label":"https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3"},{"url":"https://github.com/francescopace/espectre/pull/154","label":"https://github.com/francescopace/espectre/pull/154"},{"url":"https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1","label":"https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1"},{"url":"https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1","label":"https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T22:38:31.331Z","slug":"CVE-2026-102739","body":"## Overview\n\nESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file under micro-espectre/data, causing pickle-controlled code to execute as the maintainer or developer when a documented analysis tool accesses the field. This issue is fixed in version 3.0.0-rc1.\n\n## Affected\n\n- `espectre < 3.0.0-rc1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}