CVE-2026-9147-uproot-rce

CVE-2026-9147: uproot Code Injection via TStreamerInfo Metadata Severity: High, CVSS 4.0 8.5 , CVSS 3.1 7.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: uproot = 5.7....

uproot 5.7.4 TStreamerInfo Metadata Code Injection

uproot versions through 5.7.4 generate Python reader code from ROOT TStreamerInfo metadata without safely quoting some file-controlled fields, allowing code injection when a crafted ROOT file is processed. The proof of concept writes a local marker file. https://packetstorm.news/download/235224...

uproot 5.7.4 TStreamerInfo Code Injection

uproot version 5.7.4 and prior contain a code injection vulnerability in the handling of ROOT TStreamerInfo metadata where attacker-controlled streamer fields are incorporated into dynamically generated Python source without sufficient quoting. A malicious ROOT file can therefore cause arbitrary...

Exploit for CVE-2026-9147

CVE-2026-9147: uproot Code Injection via TStreamerInfo Metadat...

SUSE CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

Arbitrary Code Injection

Overview uproot is a ROOT I/O in pure Python and NumPy. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TStreamerInfo metadata processing. An attacker can execute arbitrary Python code by supplying a crafted ROOT file containing malicious streamer metadata...

analysisg (>=4.1.7, <=4.5.8), f9columnar (>=0.1.10, <=0.2.6) +11 more potentially affected by CVE-2026-9147 via uproot (>=5.0.4, <=5.6.9)

uproot PYPI version =5.0.4, =4.1.7, =0.1.10, =2023.1.0, =0.28.0, =1.5.2, =0.3.10, =0.1.3, =0.2.8, =5.0.0, =0.3.0rc1, =0.4.13, =0.4.17 Source cves: CVE-2026-9147 Source advisory: SNYK:PYTHON-UPROOT-18508056...

CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

CVE-2026-9147 uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

EUVD-2026-45374

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

CVE-2026-9147 uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

CVE-2026-9147 uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...

analysisg (>=4.1.7, <=4.5.8), ax-env (>=0.2.2, <=0.3.3) +38 more potentially affected by CVE-2026-9147 via uproot (>=3.10.12, <=5.6.9)

uproot PYPI version =3.10.12, =4.1.7, =0.2.2, =0.6.47, =0.4.0, =0.1.10, =0.21.0, =1.0.0a1, =1.0.0a6, =1.0.0a12, =2023.1.0, =2023.2.0 and more Source cves: CVE-2026-9147 Source advisory: MEND:CVE-2026-9147...

CVE-2026-9147: Improper Control of Generation of Code

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...