CVE-2026-120499: falha de alta gravidade em h5io
h5io before 0.2.6 Arbitrary Code Execution via read_hdf5
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5
h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
h5io · h5ioReferências
https://github.com/h5io/h5io/blob/h5io-0.2.5/h5io/_h5io.py#L601-L604https://github.com/h5io/h5io/commit/afff1d61b31790f8c27e6c577bb7703eb1883dddhttps://github.com/h5io/h5io/releases/tag/h5io-0.2.6https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737https://www.vulncheck.com/advisories/h5io-before-0.2.6-arbitrary-code-execution-via-read-hdf5