---
id: CVE-2026-120833
title: >-
  labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle
  Auto-Dispatch
summary: >-
  labbench before 0.46.1 contains a deserialization of untrusted data
  vulnerability in read() and read_relational() that passes any file with a .p
  or .pickle extension to pandas.read_pickle based on the extension alone.
  Attackers who suppl…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-502
vendor: NIST
product: labbench
affected:
  - labbench < 0.46.1
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T00:13:42.998Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120833'
references:
  - url: 'https://github.com/usnistgov/labbench/pull/32'
    label: 'GitHub Pull Request #32'
  - url: >-
      https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54
    label: Patch Commit
  - url: >-
      https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666
  - url: 'https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md'
    label: labbench ChangeLog
  - url: 'https://pypi.org/project/labbench/0.46.1/'
  - url: 'https://github.com/usnistgov/labbench'
  - url: >-
      https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch
    label: >-
      VulnCheck Advisory: labbench before 0.46.1 Deserialization of Untrusted
      Data via read() Pickle Auto-Dispatch
tags:
  - cve.org
epss: 0.00144
epssPercentile: 0.0374
ingestedAt: '2026-11-05T19:30:42.886Z'
---

## Overview

labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.

## Affected

- `labbench < 0.46.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.