{"id":"CVE-2026-120499","kind":"vulnerability","aliases":["CVE-2026-120499"],"related":[],"title":"h5io: crafted HDF5 file lets attackers run arbitrary Python code","description":"h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read.","summary":"h5io is a Python library for reading and writing HDF5 files, and before version 0.2.6 its read_hdf5() function evaluates attacker-controlled content from a file. A crafted HDF5 file can make the reader run arbitrary Python code, through an eval() of a node named timezone, an arbitrary module import, or pickled data in pandas nodes.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-pipelines","h5io","hdf5","package","python"],"not_affected_if":["trusted-files-only","version-0.2.6-or-later"],"how_to_check":"- Check the installed h5io version with `pip show h5io` and compare it to the fixed release.\n- Search your code for calls to `read_hdf5` and note whether it opens files from untrusted sources.","fix":"- h5io: move to `0.2.6` or later.","status":"open","published_at":"2026-11-05T17:18:00+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:11+00:00","updated_at":"2026-11-05T17:42:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T17:42:11Z","model":"claude-haiku-5-5","output":{"fix":"- h5io: move to `0.2.6` or later.","reach":"unknown","title":"h5io: crafted HDF5 file lets attackers run arbitrary Python code","impact":"high","summary":"h5io is a Python library for reading and writing HDF5 files, and before version 0.2.6 its read_hdf5() function evaluates attacker-controlled content from a file. A crafted HDF5 file can make the reader run arbitrary Python code, through an eval() of a node named timezone, an arbitrary module import, or pickled data in pandas nodes.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","h5io","hdf5","data-pipelines"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker runs arbitrary Python code on the reading machine","analyst_note":"","how_to_check":"- Check the installed h5io version with `pip show h5io` and compare it to the fixed release.\n- Search your code for calls to `read_hdf5` and note whether it opens files from untrusted sources.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.2.6-or-later","trusted-files-only"],"who_is_affected":"Any application that calls h5io's read_hdf5() on HDF5 files that could come from outside the team, such as user uploads or downloaded datasets. Applications that only read files the team created themselves and that run with no untrusted input are lower risk. unknown for further detail on default configurations.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4358,"output_tokens":550,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120499':13A,16A '-2026':12A,15A '0.2.6':38B,83C 'allow':93C 'arbitrari':8A,60B,72B,97C,126C 'attack':6A,45B,94C,105C 'attacker-control':44B 'builtin':122C 'class':129C,137C 'code':10A,62B,86C,98C,109C 'contain':84C 'content':47B 'control':46B 'craft':2A,52B,102C 'custom':132C 'custom-object':131C 'cve':11A,14A 'data':18B,77B 'data-pipelin':17B 'datafram':145C 'deseri':152C 'eval':65B,120C 'evalu':43B 'execut':96C 'file':4A,34B,50B,54B,104C 'function':42B 'h5io':1A,20B,24B,81C 'hdf5':3A,21B,33B,41B,53B,91C,103C 'import':74B,136C,138C 'inject':87C 'let':5A 'librari':28B 'make':56B 'modul':73B,127C 'name':69B,124C 'node':68B,80B,112C,134C,149C 'object':133C,142C 'packag':22B 'panda':79B,151C 'pass':118C 'pd':144C,147C 'pickl':76B,141C 'pipelin':19B 'place':140C 'python':9A,23B,27B,61B,108C 'reachabl':123C 'read':30B,40B,90C,117C,154C 'reader':58B 'run':7A,59B 'seri':148C 'store':107C 'suppli':100C 'timezon':70B,114C 'titl':113C 'triag':116C 'version':37B 'vulner':88C 'write':32B","nicknames":[],"mitigations":[],"who_affected":"Any application that calls h5io's read_hdf5() on HDF5 files that could come from outside the team, such as user uploads or downloaded datasets. Applications that only read files the team created themselves and that run with no untrusted input are lower risk. unknown for further detail on default configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datapipelines","h5io","hdf5","high","package","python"],"campaign_type":null,"first_public_at":"2026-11-05T16:19:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120499","severity":null,"published_at":"2026-11-05T17:18:00+00:00","modified_at":"2026-11-05T17:18:00+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null}],"documents":[{"id":78089,"url":"https://github.com/h5io/h5io/commit/afff1d61b31790f8c27e6c577bb7703eb1883ddd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78090,"url":"https://github.com/h5io/h5io/releases/tag/h5io-0.2.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78091,"url":"https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-05T16:19:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":78092,"url":"https://www.vulncheck.com/advisories/h5io-before-0.2.6-arbitrary-code-execution-via-read-hdf5","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}