High severity · published May 27, 2026
CVE-2026-47161
RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization
8.7
CVSS
0.6%
EPSS
No
On KEV
Description
RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb, RELATE LMS configures its Celery workers to accept and deserialize untrusted 'pickle' data. An attacker who can reach the message broker can execute arbitrary commands on the host server. Combined with missing network isolation in the code execution sandbox, this allows an authenticated student to achieve full Remote Code Execution (RCE) on the host system. Commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb fixes the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
relate · inducer
< d66ba5659b459bf1ba56b7109b5f9ecf197cbefb · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47161
github.com
https://github.com/inducer/relate/commit/d66ba5659b459bf1ba56b7109b5f9ecf197cbefb
github.com
https://github.com/inducer/relate/security/advisories/GHSA-4mwh-mwv4-m252
More from relate
8.8
CVE-2024-32407
An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature
8.7
CVE-2026-42197
RELATE Vulnerable to Stored XSS via Unprivileged User Profile
8.7
CVE-2026-41505
RELATE: Predictable Token Generation in auth.py and exam.py
8.1
CVE-2026-41588
RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()
7.5
CVE-2024-32406
Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Batch-Issue…