CVE-2026-120833

Description

labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: HIGH
CVSS score: 8.5 / 10
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Effective score: 8.5 / 10 HIGH source: CNA overview
CWE(s): CWE-502
Reserved: 2026-11-03
Published: 2026-11-03 00:13 UTC
Last updated: 2026-11-03 00:13 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120833.json
Linked Threat: CVE-2026-120833 — labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-115652
Assigner: VulnCheck
Published: Nov 3, 2026, 12:13:42 AM
Updated: Nov 3, 2026, 12:13:42 AM
EUVD base score (CVSS 4.0): 8.5 / 10
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: NIST
Products: labbench (0 <0.46.1)
Aliases: GHSA-4ppf-9g5f-q8hv

ENISA description: labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.

EUVD references (7)

Affected products (1)

Vendor	Product	Versions	Platforms
NIST	labbench	`0` (affected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

GitHub Pull Request #32 patchissue-tracking
Patch Commit patch
https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666 technical-description
labbench ChangeLog release-notes
https://pypi.org/project/labbench/0.46.1/ product
https://github.com/usnistgov/labbench product
VulnCheck Advisory: labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch third-party-advisory

MITRE references (7) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/usnistgov/labbench product
https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666 technical-description
labbench ChangeLog release-notes
Patch Commit patch
GitHub Pull Request #32 patch, issue-tracking
https://pypi.org/project/labbench/0.46.1/ product
VulnCheck Advisory: labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

August 2026 Critical Security Patch Update Released - Oracle Blogs

web:blogs.oracle.com

For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

2026-11-03 11:18 UTC
CVE-2026-120833 · labbench · CVSS 7.8 · CVE Brief Analyst Report

web:cvebrief.com

Remediation Immediate Action: Update the labbench library to version 0.46.1 or later immediately, as this version contains the necessary logic changes to prevent insecure deserialization. Proactive Monitoring: Review file system access logs for the creation or modification of .p or .pickle files by untrusted sources.

2026-11-03 11:18 UTC
CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-03 11:18 UTC
Current Common Vulnerabilities and Exposures - Feedly

web:feedly.com

Welcome to Feedly CVEs — Research critical vulnerabilities ( CVEs ) with all the real-time and historical information you need to assess the risk to your organization. This free resource uses Feedly's AI to synthesize and analyze vulnerability information from across the web, including estimating CVSS scores up to 3 days before it's reported to the NVD.

2026-11-03 11:18 UTC
Cisco Meraki Security Hardening Release: October 2026

web:sec.cloudapps.cisco.com

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching ...

2026-11-03 11:18 UTC
labbench CVE-2026-120833 (HIGH 8.5) - vuln.today

web:vuln.today

This Week: patch available. CVE-2026-120833 in labbench - HIGH 8.5. CVE-2026-120833 affects the labbench Python library, allowing arbitrary code…

2026-11-03 11:18 UTC
Top Vulnerability Remediation Tools in 2026 | Aikido

web:www.aikido.dev

Vulnerability remediation tools find security weaknesses in code and infrastructure and help teams fix them. Those weaknesses can come from a flaw in the code your team wrote, or a vulnerable open-source dependency, or a misconfigured server or cloud resource. The fix differs by origin. Fixing a vulnerability in a dependency usually means upgrading to a patched release, which fails when no ...

2026-11-03 11:18 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-11-03 11:18 UTC
Oracle Critical Security Patch Update Advisory - September 2026

web:www.oracle.com

Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

2026-11-03 11:18 UTC
The CVE Database: Curated Vulnerability Intelligence by Wiz | Wiz

web:www.wiz.io

Wiz's CVE Database curates CVE data to create easy-to-navigate profiles that cover the entire vulnerability timeline, exploit scenarios, and mitigation steps.

2026-11-03 11:18 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-120833.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/labbench",
          "product": "labbench",
          "repo": "https://github.com/usnistgov/labbench",
          "vendor": "NIST",
          "versions": [
            {
              "lessThan": "0.46.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dilanka Kaushal Hewage (r3vpwnx)"
        }
      ],
      "datePublic": "2026-11-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T00:13:42.998Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Pull Request #32",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/usnistgov/labbench/pull/32"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666"
        },
        {
          "name": "labbench ChangeLog",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://pypi.org/project/labbench/0.46.1/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/usnistgov/labbench"
        },
        {
          "name": "VulnCheck Advisory: labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch"
        }
      ],
      "title": "labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-120833",
    "datePublished": "2026-11-03T00:13:42.998Z",
    "dateReserved": "2026-11-03T00:06:11.273Z",
    "dateUpdated": "2026-11-03T00:13:42.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}