High severity7.8NVD Advisory· Published Nov 3, 2026
CVE-2026-120833
CVE-2026-120833
Description
labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.pynvd
- github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.mdnvd
- github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54nvd
- github.com/usnistgov/labbench/pull/32nvd
- pypi.org/project/labbench/0.46.1/nvd
- www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatchnvd
News mentions
0No linked articles in our index yet.