GitHub Advisoryadvisory · PyPI

GHSA-9fq2-x9r6-wfmf Numpy Deserialization of Untrusted Data

CRITICAL Published 2022-05-24 Modified 2026-07-06 Official page ↗
Aliases
CVE-2019-6446
Ecosystem
PyPI
Packages
numpy
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-07-18

Affected packages

• PyPI numpy: < 1.16.3 → fixed in 1.16.3

Description

DISPUTED An issue was discovered in NumPy 1.16.2 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.

Related

Alias · CVE (1)

  • CVE-2019-6446 An issue was discovered in NumPy before 1.16.3. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References