Threats tagged 'ghsa-4ppf-9g5f-q8hv'

labbench versions before 0.46.1 have a vulnerability in the read() and read_relational() functions that deserialize untrusted data. These functions pass any file with a .p or .pickle extension to pandas.read_pickle based solely on the file extension. This behavior allows attackers to craft malicious data files that, when loaded, can execute arbitrary code.