Uproot
Monthly
Arbitrary Python code execution in scikit-hep uproot (uproot5) arises because the library dynamically generates and compiles reader classes from a ROOT file's TStreamerInfo records, interpolating file-controlled streamer metadata (such as streamer element names) into generated Python source without repr()/!r safe quoting. A crafted ROOT file can inject expression-breaking content that is evaluated in the process opening the file, giving code execution to whoever processes attacker-supplied ROOT data. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary Python code execution in scikit-hep uproot (uproot5) arises because the library dynamically generates and compiles reader classes from a ROOT file's TStreamerInfo records, interpolating file-controlled streamer metadata (such as streamer element names) into generated Python source without repr()/!r safe quoting. A crafted ROOT file can inject expression-breaking content that is evaluated in the process opening the file, giving code execution to whoever processes attacker-supplied ROOT data. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.