PT-2020-13328 · Pandas Development Team+2 · Pandas+2
Published
2020-05-15
·
Updated
2025-10-09
·
CVE-2020-13091
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
pandas versions 1.0.0 through 1.0.3
Description
The issue allows untrusted files passed to the
read pickle() function to potentially unserialize and execute commands, specifically if reduce makes an os.system call. It is noted that the read pickle() function is documented as unsafe, and users are responsible for using it securely. There is a dispute regarding this issue from third parties.Recommendations
For versions 1.0.0 through 1.0.3, consider avoiding the use of untrusted files with the
read pickle() function until a secure approach is implemented. As a temporary workaround, restrict the use of files that could potentially make os.system calls through the reduce method. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Pandas