---
id: CVE-2026-102739
title: 'ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution'
summary: >-
  ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1,
  Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py,
  tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets
  with Nu…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-502
vendor: francescopace
product: espectre
affected:
  - espectre < 3.0.0-rc1
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:09:12.295Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102739'
references:
  - url: >-
      https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3
    label: >-
      https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3
  - url: 'https://github.com/francescopace/espectre/pull/154'
    label: 'https://github.com/francescopace/espectre/pull/154'
  - url: >-
      https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1
    label: >-
      https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1
  - url: 'https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1'
    label: 'https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1'
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.331Z'
---

## Overview

ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file under micro-espectre/data, causing pickle-controlled code to execute as the maintainer or developer when a documented analysis tool accesses the field. This issue is fixed in version 3.0.0-rc1.

## Affected

- `espectre < 3.0.0-rc1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.