Security Flaw in aeon Library Affects Python Users

CVE-2026-65820

What is CVE-2026-65820?

The aeon library, designed for time series analysis in Python, had a vulnerability affecting its GitHub Actions workflow prior to version 1.5.0. The workflow utilized the pull_request_target event, allowing forked code to run in a privileged environment. This configuration could lead to the execution of malicious code, leveraging elevated credentials and potentially enabling an attacker to push harmful changes back to the original repository. This risk underlines the importance of security in CI/CD environments, and a patch has been implemented in version 1.5.0 to mitigate these concerns.

References