CVE-2026-120833

HIGH 7.8

labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.

CWE	CWE-502
Vendor	nist
Product	labbench
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for nist labbench

Be the first to know when new high vulnerabilities affecting nist labbench are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

NIST / labbench

0 < 0.46.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/usnistgov/labbench/pull/32 github.com: https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54 github.com: https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666 github.com: https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md pypi.org: https://pypi.org/project/labbench/0.46.1/ github.com: https://github.com/usnistgov/labbench vulncheck.com: https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch

Credits

Dilanka Kaushal Hewage (r3vpwnx)