Threats affecting pkg:pypi/labbench

NIST labbench versions before 0.46.1 contain a deserialization of untrusted data vulnerability in the read() and read_relational() functions. These functions pass any file with a .p or .pickle extension to pandas.read_pickle based solely on the file extension, allowing attackers to execute arbitrary code by supplying crafted data files. This vulnerability is fixed in version 0.46.1.