CVE-2026-65820

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

CVE-2026-65820 aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

CVE-2026-65820 aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

CVE-2026-65820

The aeon Python library (a scikit-learn compatible library for time series) is vulnerable in versions prior to 1.5.0 . A GitHub Actions workflow utilized pull_request_target for pre-commit checks, allowing code from malicious forks to be executed in a privileged context . This configuration could...

CVE-2026-65820

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

EUVD-2026-123767

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

CVE-2026-65820: aeon-toolkit aeon: aeon is a scikit-learn compatible Python library for learning from time series

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pullrequesttarget for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged...

PT-2026-145304

aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull request target for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileg...

Malicious code in larch-grape-aeon (npm)

The package larch-grape-aeon was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-18285

Aeon loadrehabpiledataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-18287

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-18286

Aeon loadhumanactivitysegmentationdatasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

aeon-neuro (0.0.1), convst (>=0.3.0, <=0.3.1) +5 more potentially affected by CVE-2026-18287 via aeon (>=0.10.0, <=1.4.0)

aeon PYPI version =0.10.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0, =0.5.0, =0.6.0 Source cves: CVE-2026-18287 Source advisory: MEND:CVE-2026-18287...

CVE-2026-18287 Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-18287 Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

EUVD-2026-63435

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-18287 Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-18287

aeon (Python time series library, aeon-toolkit/aeon) is vulnerable to code injection in the load_time_series_segmentation_benchmark method. The root cause is the lack of proper validation of a user-supplied string before it is used to execute Python code, allowing an attacker to run arbitrary cod...

CVE-2026-18287

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-18286

Aeon loadhumanactivitysegmentationdatasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicio...