Which versions of uproot are affected by CVE-2026-9147?

scikit-hep uproot5 contains a critical vulnerability enabling arbitrary Python code execution when processing specially crafted ROOT data files, with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-9147?

Within 24 hours, identify all systems running uproot5, catalog which ROOT files they process, and determine if any are sourced from untrusted origins. Within 7 days, restrict uproot5 to processing ROOT files from verified internal sources only, implement file-origin verification workflows, and document alternative ROOT libraries as contingencies. Within 30 days, establish vendor monitoring for patch releases, evaluate alternative parsing methods, and develop a migration plan to patch or replace uproot5 when a fix becomes available.

uproot CVE-2026-9147

Q: What is the CVSS score of CVE-2026-9147?

CVE-2026-9147 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45374 HIGH

Code Injection (CWE-94)

2026-07-18 VulnCheck

GHSA-98vv-9pqj-g87v

Code Injection RCE Python Uproot Suse

8.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Attacker-controlled file must be opened by the victim, so AV:L and UI:R; no auth needed (PR:N), low complexity, and code execution yields full C:H/I:H/A:H with no scope change.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 18, 2026 - 13:31 vuln.today

Analysis Generated

Jul 18, 2026 - 13:31 vuln.today

CVE Published

Jul 18, 2026 - 12:46 cve.org

HIGH 8.5

DescriptionCVE.org

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source without safe quoting via repr() or the !r format specifier. An attacker who can supply a crafted ROOT file can place Python expression-breaking content into a streamer metadata field. When uproot generates and invokes the corresponding reader method, the injected Python expression is evaluated in the context of the process opening the file, resulting in arbitrary Python code execution in applications that open or process attacker-controlled ROOT files with affected uproot code paths.

AnalysisAI

Arbitrary Python code execution in scikit-hep uproot (uproot5) arises because the library dynamically generates and compiles reader classes from a ROOT file's TStreamerInfo records, interpolating file-controlled streamer metadata (such as streamer element names) into generated Python source without repr()/!r safe quoting. A crafted ROOT file can inject expression-breaking content that is evaluated in the process opening the file, giving code execution to whoever processes attacker-supplied ROOT data. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

uproot is a pure-Python reader for the CERN ROOT columnar file format widely used in high-energy physics. To deserialize custom C++ classes stored in a ROOT file, uproot reads the embedded TStreamerInfo schema and synthesizes Python reader methods on the fly, then compiles them at runtime. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): several f-strings in src/uproot/streamers.py (the class_code generator) and an eval() in identify.py embedded attacker-influenced metadata - streamer element names, count names, and field names - directly into generated source. Because these values originate entirely from the file rather than trusted code, and were not passed through repr() or escaped, a value containing quote characters or Python expressions breaks out of the intended string literal and executes.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor's patched release once identified, tracking GHSA-6946-mq52-g438 (https://github.com/scikit-hep/uproot5/security/advisories/GHSA-6946-mq52-g438) and the fix commit c045c2824295d907d2e705f31110c742928e50e7 which introduces a _sanitize_string() helper, switches generated error messages to the !r (repr) format specifier, and replaces eval() with ast.literal_eval() in identify.py. Until a tagged patched version is confirmed and deployed, do not open or process ROOT files from untrusted or externally-supplied sources with vulnerable uproot code paths; where files must be ingested, run uproot inside an isolated sandbox or unprivileged container with no network egress and minimal filesystem access so that any injected code cannot pivot (trade-off: added pipeline complexity and latency). Validate provenance of ROOT files (restrict to trusted producers) as a compensating control, accepting that this does not stop a compromised upstream producer. Cite the exact fixed version from the vendor advisory when patching; do not assume a version number not published by the vendor.