{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/h5io--0.2.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:h5io:h5io:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-120499"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["h5io (\u003c 0.2.6)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe h5io Python library, specifically in versions prior to 0.2.6, contains a code injection vulnerability within the read_hdf5() function. An attacker can craft a malicious HDF5 file containing specific node structures that, when processed, lead to arbitrary code execution. The vulnerability stems from three primary mechanisms:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eThe timezone node is passed to eval() with builtins enabled.\u003c/li\u003e\n\u003cli\u003eclass or custom-object nodes allow for arbitrary module imports via _import_class().\u003c/li\u003e\n\u003cli\u003epd_dataframe or pd_series nodes contain pickled objects that are insecurely deserialized by pandas.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution with the privileges of the application process that invokes the read_hdf5() function.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the h5io library to version 0.2.6 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit applications that process externally sourced HDF5 files using h5io.\u003c/li\u003e\n\u003cli\u003eImplement sandboxing or containerization for untrusted file processing workloads to limit the impact of code execution vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T18:23:14Z","date_published":"2026-11-05T18:23:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-h5io-rce/","summary":"The h5io library before version 0.2.6 is vulnerable to arbitrary code execution via crafted HDF5 files that trigger unsafe eval, arbitrary imports, or insecure pickle deserialization during data loading.","title":"h5io: Arbitrary code execution in read_hdf5 (CVE-2026-120499)","url":"https://feed.craftedsignal.io/briefs/2026-11-h5io-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - H5io (\u003c 0.2.6)","version":"https://jsonfeed.org/version/1.1"}