{"id":"CVE-2026-120833","title":"labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch","summary":"labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who suppl…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-502"],"vendor":"NIST","product":"labbench","affected":["labbench < 0.46.1"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T00:13:42.998Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120833","references":[{"url":"https://github.com/usnistgov/labbench/pull/32","label":"GitHub Pull Request #32"},{"url":"https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54","label":"Patch Commit"},{"url":"https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666"},{"url":"https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md","label":"labbench ChangeLog"},{"url":"https://pypi.org/project/labbench/0.46.1/"},{"url":"https://github.com/usnistgov/labbench"},{"url":"https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch","label":"VulnCheck Advisory: labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch"}],"tags":["cve.org"],"epss":0.00144,"epssPercentile":0.0374,"ingestedAt":"2026-11-05T19:30:42.886Z","slug":"CVE-2026-120833","body":"## Overview\n\nlabbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.\n\n## Affected\n\n- `labbench < 0.46.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}