Arbitrary Code Execution in Ibis PyArrow Dependency
Summary
GHSA-x563-6hqv-26mr: Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file. Affects ibis-framework versions < 7.1.0. Fixed in 7.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ibis is a Python library that provides a high-level API for querying and manipulating structured data. It is commonly used for data analysis and exploration. PyArrow is a dependency of Ibis that enables efficient interchange of data between Python and Arrow, a columnar in-memory analytics format. PyArrow versions 0.14.0 to 14.0.0 are vulnerable to arbitrary code execution when loading a malicious data file. This vulnerability arises from the deserialization of untrusted data in IPC and Parquet readers.
Vulnerability Detail
The vulnerability allows an attacker to execute arbitrary code by providing a specially crafted IPC, Feather, or Parquet data file. This can lead to various security risks, including remote code execution, data corruption, and unauthorized access to sensitive information. It is important to note that this vulnerability only affects PyArrow and not other Apache Arrow implementations or bindings. While Ibis itself has limited usage of the vulnerable APIs, the Pandas and Dask backends, which use PyArrow to read Parquet files, are also affected.
How To Fix
Latest published version: 12.0.0 as of 22 Oct 2026
pip install --upgrade "ibis-framework==12.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.1.0
This is the first release that contains the fix.
pip install --upgrade "ibis-framework==7.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To apply the workaround, follow these steps:
- Install the
pyarrow-hotfixpackage using pip:
pip install pyarrow-hotfix
- Add the following import statement at the beginning of your code:
import pyarrow_hotfix
This workaround ensures that the pyarrow_hotfix package is imported before any import ibis statements, mitigating the vulnerability.
Conclusion
The vulnerability in the Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file. It is crucial to apply the recommended fixes, either by importing the pyarrow_hotfix package or upgrading to Arrow 14.0.1 or higher. Failure to address this vulnerability can result in severe security risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ibis-framework →
FAQ
The vulnerability allows arbitrary code execution, which can lead to various security risks such as remote code execution, data corruption, and unauthorized access to sensitive information.
No, this vulnerability only affects Ibis versions 0.14.0 to 14.0.0. Upgrading to Ibis 7.1.0 or higher resolves the vulnerability.
Yes, installing the pyarrow-hotfix package and importing pyarrow_hotfix before any import ibis statements can mitigate the vulnerability.
The Pandas and Dask backends of Ibis, which use PyArrow to read Parquet files, are affected by this vulnerability.
Yes, the CVE identifier for this vulnerability is CVE-2023-47248.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
