Code Injection Vulnerability in h5io Affected Product by H5IO
CVE-2026-120499

8.5HIGH

Key Information:

Vendor

H5io

Status
H5io
Vendor
CVE Published:
5 November 2026

What is CVE-2026-120499?

The h5io library versions prior to 0.2.6 contain a code injection vulnerability in the read_hdf5() function. This flaw allows attackers to execute arbitrary code by providing specially crafted HDF5 files. An attacker can embed malicious Python code in a node labeled 'timezone', which is subsequently processed by the _triage_read() function using eval() with accessible built-in functions. Additionally, attackers can designate arbitrary modules within class or custom-object nodes, which are imported by the _import_class() function, or inject pickled objects into pd_dataframe or pd_series nodes that are deserialized by pandas during the read process. Due to this vulnerability, the integrity and security of applications utilizing h5io are at risk.

Affected Version(s)

h5io 0.1.0 < 0.2.6

References

https://github.com/h5io/h5io/security/advisories/GHSA-vwv...
vendor-advisory
https://github.com/h5io/h5io/commit/afff1d61b31790f8c27e6...
patch
https://github.com/h5io/h5io/releases/tag/h5io-0.2.6
release-notes

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dilanka Kaushal Hewage (r3vpwnx)
.