{"id":"GHSA-436v-jg82-p533","aliases":["CVE-2026-21531","PYSEC-2026-289"],"title":"Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE","description":"Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.","severity":"critical","score":9.8,"published":"2026-02-10T18:30:42.000Z","modified":"2026-10-27T15:30:04.364Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"azure-ai-language-conversations-authoring","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.0b4"}],"type":"ECOSYSTEM"}],"versions":["1.0.0b1","1.0.0b2","1.0.0b3"],"fixed":["1.0.0b4"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-21531","https://github.com/Azure/azure-sdk-for-python","https://github.com/pypa/advisory-database/tree/main/vulns/azure-ai-language-conversations-authoring/PYSEC-2026-289.yaml","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531","https://pypi.org/project/azure-ai-language-conversations-authoring"],"sources":[{"name":"OSV","id":"GHSA-436v-jg82-p533","modified":"2026-10-27T15:30:04.364585856Z","url":"https://osv.dev/vulnerability/GHSA-436v-jg82-p533"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}