Command Execution Vulnerability in pandas
Summary
CVE-2020-13091: pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if reduce makes an os.system call. Affects pandas versions < 3adf3340453d6704d4a2cb47058214cc697a7d29. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pandas is a popular open-source data analysis and manipulation library for Python. It provides data structures and functions for efficiently handling and analyzing large datasets. The library is widely used in various domains, including data science, finance, and research. However, a vulnerability has been discovered in pandas versions up to 1.0.3 that allows for command execution from an untrusted file passed to the read_pickle() function.
Vulnerability Detail
The vulnerability, identified as CVE-2020-13091, arises due to the deserialization of untrusted data by the read_pickle() function. If the reduce method of the deserialized object makes an os.system call, arbitrary commands can be executed on the system. It is important to note that the read_pickle() function is documented as unsafe, and it is the responsibility of the user to use it securely. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary commands with the privileges of the user running the vulnerable code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a possible workaround is to avoid using the read_pickle() function with untrusted data. Instead, consider using alternative methods for data serialization and deserialization that provide better security guarantees. Additionally, it is crucial to validate and sanitize any input data before passing it to the read_pickle() function.
Conclusion
The command execution vulnerability in pandas versions up to 1.0.3 can have severe consequences, allowing for arbitrary code execution. It is crucial to upgrade to a patched version of pandas to mitigate this vulnerability. Additionally, it is recommended to review and secure the usage of the read_pickle() function. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pandas →
FAQ
pandas is an open-source data analysis and manipulation library for Python. It provides powerful data structures and functions for efficiently working with structured data.
The vulnerability allows for command execution from an untrusted file, potentially leading to arbitrary code execution with the privileges of the user running the vulnerable code.
Yes, the vulnerability has been fixed in pandas versions later than 1.0.3. It is recommended to upgrade to the latest stable release to ensure the fix is applied.
While upgrading to a patched version is the best solution, if immediate upgrade is not possible, avoiding the use of read_pickle() with untrusted data and implementing input validation can help mitigate the risk.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to address the vulnerability promptly to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for pandas.
