HighPublic exploit

Unsafe Deserialization in Comma AI Openpilot 0.11 modeld

IdentifiersCVE-2026-12191CWE-502· Deserialization of Untrusted Data

CVE-2026-12191 is an unsafe deserialization vulnerability in Comma AI Openpilot 0.11. The issue is associated with use of Python's pickle.load and pickle.loads in selfdrive/modeld/modeld.py. Because pickle deserialization can execute attacker-controlled object reconstruction logic, processing untrusted serialized input can result in arbitrary code execution or other unintended behavior. The vulnerable condition is limited to scenarios where an attacker has local access and can influence the data passed into the affected deserialization path.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow execution of attacker-controlled code or other malicious actions in the local security context of the affected Openpilot component. Depending on the privileges of the process and the surrounding deployment, this could enable compromise of the local system, tampering with application behavior, or further post-exploitation activity.

Mitigation

If you can’t patch tonight, do this now.

Restrict local access to affected systems to trusted administrators and processes only. Prevent untrusted local users, containers, or services from supplying serialized data to the vulnerable code path. Where feasible, disable or avoid the affected functionality, harden file and process permissions around the Openpilot environment, and monitor for unexpected modification of inputs consumed by the modeld component.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-fixed release if one becomes available. In the affected code path, eliminate use of pickle.load and pickle.loads for untrusted data and replace them with a safer serialization format that does not permit code execution during deserialization. If serialized object handling is required, enforce strict trust boundaries, validate provenance of input, and redesign the feature so only authenticated, integrity-protected, trusted data can reach the deserialization routine.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2026-12191MaturityOperationalVerified exploit

Repository is a small standalone Python PoC for CVE-2026-12191, described as an insecure deserialization flaw in Comma AI Openpilot 0.11's selfdrive/modeld/modeld.py. Structure is simple: README.md documents the issue and impact; exploit.py is a minimal payload generator; generate_payloads.py is the main attacker-side script that creates malicious pickle files; simulate_victim.py reproduces the vulnerable deserialization paths to demonstrate exploitation. Core exploit capability is arbitrary code execution via Python pickle deserialization. The code abuses pickle's __reduce__ mechanism so that unpickling invokes dangerous callables such as os.system or eval. The minimal exploit writes `/tmp/PWNED.txt` using `id > /tmp/PWNED.txt`. The more complete generator creates two payloads: (1) an info/proof payload that runs embedded Python and writes execution details to `payloads/PWNED.txt`, and (2) a stealth payload that both executes code and returns a forged metadata dictionary matching expected model metadata fields (`model_checkpoint`, `output_slices`, `input_shapes`, `output_shapes`). This second variant is notable because it is designed to let the vulnerable process continue operating without obvious failure. The simulated victim script demonstrates both vulnerable patterns from the target application: `pickle.load(f)` on a file handle and `pickle.loads(data)` on raw bytes read from disk. It confirms exploitation by checking for the marker file and printing returned object types/keys. No network communication, C2, or remote delivery is implemented; this is a local/file-based exploit requiring attacker control over pickle files consumed by modeld. Overall, this is a valid operational PoC showing practical local RCE and stealthy post-deserialization behavior against the referenced Openpilot component.

hakaioffsecDisclosed Jul 20, 2026markdownpythonlocalfile

ACTIVITY FEED

Recent activity

6 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

6 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6