critical9.8
CVE-2026-21531
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
Impact
Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | azure-ai-language-conversations-authoring | < 1.0.0b4 | 1.0.0b4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Azure Conversation Authoring Client Library | Version 1.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-436v-jg82-p533
- https://nvd.nist.gov/vuln/detail/CVE-2026-21531
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531
- https://github.com/pypa/advisory-database/tree/main/vulns/azure-ai-language-conversations-authoring/PYSEC-2026-289.yaml
- https://pypi.org/project/azure-ai-language-conversations-authoring