CVE-2026-120833— labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch

Quick assessment

Affected

NIST labbench

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 0.46.1 版本之前的 LabBench 存在不受信任数据反序列化漏洞。该漏洞位于和函数中：这些函数仅依据文件扩展名（或）便将任意文件传递给。攻击者若提供精心构造的数据文件或关系型数据归档，当用户使用上述函数加载时，即可触发任意代码执行。

CVSS 7.8 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch

Source: CVE Program / CVE List V5

Vulnerability Description

labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
NIST	labbench	0 ~ 0.46.1	-

II. Public POCs for CVE-2026-120833

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120833

请登录查看更多情报信息。

Other References for CVE-2026-120833 (7)

https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666 technical-description
https://pypi.org/project/labbench/0.46.1/ product
https://github.com/usnistgov/labbench product
https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54 patch
https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md release-notes
https://github.com/usnistgov/labbench/pull/32 patch issue-tracking
https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120833

IV. Related Vulnerabilities

Same weakness: CWE-502