CVE-2026-120833 Details
Description
labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.
A deserialization vulnerability has been identified in labbench versions prior to 0.46.1. This issue arises in the read() and read_relational() functions, where any file with a .p or .pickle extension is automatically passed to pandas.read_pickle, based solely on the file extension. This behavior allows attackers to execute arbitrary code by supplying a crafted data file or relational data archive, which is then loaded by the user using these functions.
Users can update to labbench version 0.46.1 or later, where this vulnerability has been addressed. Instructions for updating are available on the labbench PyPI page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| labbench | >= 0, < 0.46.1 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |