Deserialization Vulnerability in labbench Affects Untrusted Data Handling
CVE-2026-120833

8.5HIGH

Key Information:

Vendor

Nist

Status
Labbench
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120833?

The labbench application prior to version 0.46.1 contains a vulnerability in the read() and read_relational() functions, allowing attackers to exploit deserialization of untrusted data. This issue arises when a file with a .p or .pickle extension is processed, enabling potential execution of arbitrary code by supplying a crafted data file or relational archive. Users are advised to update to version 0.46.1 or later to mitigate this risk.

Affected Version(s)

labbench 0 < 0.46.1

References

https://github.com/usnistgov/labbench/pull/32
patchissue-tracking
https://github.com/usnistgov/labbench/commit/ac9b9b18cba6...
patch
https://github.com/usnistgov/labbench/blob/0.46.0/src/lab...
technical-description

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dilanka Kaushal Hewage (r3vpwnx)
.