{"id":"CVE-2026-120833","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-120833","summary":"labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch","details":"labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.","published":"2026-11-03T00:13:42.998Z","modified":"2026-11-04T02:47:30.091108950Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54","label":"usnistgov/labbench@ac9b9b1"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120833.json"},{"type":"ADVISORY","url":"https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120833"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch"},{"type":"FIX","url":"https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54"},{"type":"FIX","url":"https://github.com/usnistgov/labbench/pull/32"},{"type":"PACKAGE","url":"https://github.com/usnistgov/labbench"},{"type":"PACKAGE","url":"https://pypi.org/project/labbench/0.46.1/"},{"type":"ARTICLE","url":"https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-04T02:47:30.091108950Z"}}