CVE-2020-13091

Published: May 15, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner

Affected (1)

Products: Numfocus: Pandas

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Numfocus Pandas	Up to 1.0.3

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://github.com/0FuzzingQ/vuln/blob/master/pandas%20unserialize.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://pandas.pydata.org/pandas-docs/stable/reference/api/pandas.read_pickle.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/0FuzzingQ/vuln/blob/master/pandas%20unserialize.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://pandas.pydata.org/pandas-docs/stable/reference/api/pandas.read_pickle.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.