CVE-2026-120499

h5io before 0.2.6 contains a code injection vulnerability in readhdf5 that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which triageread passes to eval with builtins reachable, name an arbitrary module in...