h5io vulnerabilities

CVEs whose affected-version data names the h5io package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120499High· 7.8PoC

yesterday

h5io before 0.2.6 Arbitrary Code Execution via read_hdf5

h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() pa…

▾ Midnighth5io · h5iovia CVEORG