Critical severity9.8NVD Advisory· Published May 15, 2020· Updated Jun 17, 2026
CVE-2020-13091
CVE-2020-13091
Description
pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- pandas/pandasdescription
Patches
Vulnerability mechanics
References
2- github.com/0FuzzingQ/vuln/blob/master/pandas%20unserialize.mdnvdExploitThird Party Advisory
- pandas.pydata.org/pandas-docs/stable/reference/api/pandas.read_pickle.htmlnvdThird Party Advisory
News mentions
0No linked articles in our index yet.