## https://sploitus.com/exploit?id=BBB3E100-162C-5C6A-9036-8623B382686A
# CVE-2026-12191
A proof-of-concept exploit for CVE-2026-12191, an insecure deserialization vulnerability in Comma AI Openpilot's `modeld.py`, that allows a local low-privileged attacker to achieve arbitrary code execution by supplying a crafted malicious Python pickle payload to the `pickle.load()`/`pickle.loads()` deserialization routines.
## Vulnerable Versions
- Comma AI Openpilot 0.11
## Impact
The insecure deserialization vulnerability allows a local low-privileged attacker to achieve arbitrary code execution by supplying a crafted malicious Python pickle payload to the vulnerable deserialization routines. Successful exploitation enables the execution of arbitrary commands with the privileges of the Openpilot process, potentially allowing an attacker to compromise the integrity of the autonomous driving software, manipulate application behavior, access sensitive data, or establish persistent code execution on the affected device.
## CVSS
**7.8 High** `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
# Disclaimer
This tool is for educational and research purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any misuse or damage caused by this program.
# QuimeraX Intelligence
QuimeraX Intelligence is an advanced EASM and Cyber Threat Intelligence platform specializing in identifying critical vulnerabilities in complex systems. The platform proactively monitors, detects, and alerts clients about security threats, ensuring transparency and rapid response to potential risks. Clients receive immediate notifications and comprehensive reports if their systems are found vulnerable, enabling them to take protective action. [learn more](https://hakaisecurity.io/quimera-team/)
# Hakai Security
[Hakai Security](https://hakaisecurity.io/) is a cybersecurity company founded by security professionals, committed to technical excellence. We offer tailored security solutions including advanced penetration testing, realistic Red Team simulations, and secure development practices to proactively protect our clients' assets from evolving cyber threats.
# Hacking Club
[Hacking Club](https://hackingclub.com/) is the training platform where you learn cybersecurity through hands-on lessons, labs, and challenges created by experts working in our security consulting firm: straight from the battlefield to your training. Practice the vulnerability presented in this repository by the hacking club! [learn more](https://app.hackingclub.com/training/challenges/137)
# References
- https://nvd.nist.gov/vuln/detail/CVE-2026-12191
- https://hakaisecurity.io/en-build-your-nightmare-dissecting-cve-2026-12191/research-blog/
- https://docs.python.org/pt-br/3/library/pickle.html
- https://app.hackingclub.com/training/challenges/137