H5io (< 0.2.6)

The h5io library before version 0.2.6 is vulnerable to arbitrary code execution via crafted HDF5 files that trigger unsafe eval, arbitrary imports, or insecure pickle deserialization during data loading.