{"id":"CVE-2026-120499","aliases":["GHSA-vwvw-f6v4-w737"],"url":"https://o3.security/vulnerability/CVE-2026-120499","summary":"h5io before 0.2.6 Arbitrary Code Execution via read_hdf5","details":"h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read.","published":"2026-11-05T16:55:32.599Z","modified":"2026-11-07T02:48:31.537304401Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/h5io/h5io/commit/afff1d61b31790f8c27e6c577bb7703eb1883ddd","label":"h5io/h5io@afff1d6"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120499.json"},{"type":"ADVISORY","url":"https://github.com/h5io/h5io/releases/tag/h5io-0.2.6"},{"type":"ADVISORY","url":"https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120499"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/h5io-before-0.2.6-arbitrary-code-execution-via-read-hdf5"},{"type":"FIX","url":"https://github.com/h5io/h5io/commit/afff1d61b31790f8c27e6c577bb7703eb1883ddd"},{"type":"PACKAGE","url":"https://github.com/h5io/h5io"},{"type":"ARTICLE","url":"https://github.com/h5io/h5io/blob/h5io-0.2.5/h5io/_h5io.py#L601-L604"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-07T02:48:31.537304401Z"}}