Aeon Vulnerability Allows Remote Code Execution via Code Injection
A critical vulnerability in the aeon toolkit's load_human_activity_segmentation_datasets method allows remote attackers to execute arbitrary code on affected systems.
A remote code execution vulnerability, identified as ZDI-26-469 and assigned CVE-2026-18286, has been discovered in the aeon toolkit. This flaw permits attackers to execute arbitrary code on vulnerable installations, posing a significant risk to users.
The vulnerability stems from a failure to properly validate user-supplied strings before they are used in Python code execution within the load_human_activity_segmentation_datasets method. This oversight allows a malicious actor to inject and execute their own commands, effectively taking control of the affected process.
Exploitation of this vulnerability requires a degree of user interaction. Attackers must trick a user into visiting a malicious webpage or opening a specially crafted file. Once this interaction occurs, the attacker can leverage the code injection flaw to achieve arbitrary code execution within the context of the running aeon application.
The Zero Day Initiative (ZDI), which disclosed the vulnerability, has assigned it a CVSS score of 7.8, indicating a high severity level. This score reflects the potential for significant impact if the vulnerability is exploited in the wild.
Aeon, the developers of the toolkit, have acknowledged the vulnerability and have released a patch to address the issue. The fix is available through a commit on their GitHub repository, specifically at https://github.com/aeon-toolkit/aeon/commit/751918052c0cce266b4f7cd4b084408526efc015.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on February 19, 2026. Following coordinated public release efforts, the advisory was made public on July 29, 2026, with an update to the advisory also occurring on the same day.
This vulnerability was discovered by Mat Powell of TrendAI Zero Day Initiative. Users of the aeon toolkit are strongly advised to apply the available patch as soon as possible to mitigate the risk of exploitation.
The discovery and patching of this vulnerability highlight the ongoing need for diligent security practices and timely updates in software development, particularly for toolkits that handle data processing and may be integrated into larger systems.
The Zero Day Initiative advisory ZDI-26-470 details a remote code execution vulnerability in Aeon's load_time_series_segmentation_benchmark function, distinct from the previously reported load_human_activity_segmentation_datasets flaw. This new vulnerability, CVE-2026-18287, also requires user interaction and allows arbitrary code execution in the context of the current process due to improper validation of user-supplied strings before Python code execution. A patch has been released by Aeon, with the advisory updated on July 29, 2026.
The new advisory for this vulnerability, ZDI-26-468, specifically details a deserialization flaw within the load_rehab_pile_dataset method, distinct from the load_human_activity_segmentation_datasets method mentioned previously. This updated information confirms the vulnerability is triggered by deserializing untrusted data and carries a CVSS score of 7.8, requiring user interaction to exploit.