labbench CVE-2026-120833

Exploitation requires a victim to invoke labbench's read() or read_relational() on an attacker-supplied file whose name ends in .p or .pickle (or a relational data archive containing such a file); vulnerable versions dispatch to pandas.read_pickle based on the extension alone, so no authentication or special privilege is needed but user interaction (loading the file) is mandatory - consistent with AV:L/UI:P. Limiting factors: the attack is not remote/network-triggered, it depends on social engineering to deliver and have the file opened, it only affects labbench versions before 0.46.1, and in 0.46.1 loading pickle files is refused by default unless the LABBENCH_AUTOLOAD_PICKLE environment variable is explicitly set to an enabling value. The vendor states updating (with pickle auto-loading disabled by default) is the fix; opting back in via LABBENCH_AUTOLOAD_PICKLE re-enables the dangerous behavior for trusted files only.

Signals are moderate and internally consistent, pointing to a real-but-conditional risk rather than an internet-facing emergency. The provided CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H (score 8.5), meaning the vector is local and requires user interaction (a user must load a crafted file) even though no privileges are needed; the high VC/VI/VA reflects that successful unpickling yields arbitrary code execution. No EPSS score was supplied and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation; the mechanism (pickle deserialization) is trivially weaponizable but still depends on social engineering to get a victim to open a malicious .p/.pickle file. The vuln.today priority is 'this_week' (not act_now/emergency), a patch exists (0.46.1), and the issue was reported by VulnCheck with source-level confirmation. Net: a genuinely high-severity code-execution bug whose real-world urgency is tempered by the local attack vector and required user interaction and the niche deployment footprint of labbench. EPSS and KEV data are absent rather than low - treat exploitation likelihood as unquantified, not confirmed-benign.

An attacker distributes a malicious data file or relational data archive containing a crafted pickle payload (e.g. shared as experiment data, a dataset, or a results archive). When a researcher loads it in labbench with read() or read_relational(), labbench auto-dispatches any .p/.pickle file to pandas.read_pickle by extension alone, executing the attacker's embedded Python code with the victim's privileges. No public exploit was identified in the provided data, but pickle code-execution payloads are trivial to construct and the trigger path is confirmed in the source diff.