← CVE Radar
CVE-2026-120833labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch
labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.
8.5 HIGHEPSS 0.14%Not in KEVNVD: Deferred
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.5 | HIGH | 4.0VulnCheck (CNA) | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.8 | HIGH | 3.1VulnCheck (CNA) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-120833
- Status
- Deferred
- Assigner (CNA)
- VulnCheck
- Published
- Nov 3, 2026
- Last modified
- 2026-11-03 16:30 UTC
- Weaknesses
- CWE-502 · Deserialization of Untrusted Data
Affected Products
As published by the CNA in the CVE record.
NISTlabbench1 version range
- before 0.46.1
References
- github.com https://github.com/usnistgov/labbench
- github.com https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666
- github.com https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md
- github.com https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54
- github.com https://github.com/usnistgov/labbench/pull/32
- pypi.org https://pypi.org/project/labbench/0.46.1/
- vulncheck.com https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch