CVE-2014-1858: Arbitrary file write in NumPy
Summary
CVE-2014-1858: Arbitrary file write in NumPy. Affects numpy versions < 1.8.1. Fixed in 1.8.1. How to fix ↓
Also tracked for
- python-numpy · Debian:10
The same CVE-2014-1858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NumPy is a popular Python package used for scientific computing and data analysis. It provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. NumPy is widely used in various domains, including machine learning, data science, and numerical simulations. However, versions of NumPy before 1.8.1 are vulnerable to an arbitrary file write attack.
Vulnerability Detail
The vulnerability, identified as CVE-2014-1858, exists in the 'init.py' file of the 'f2py' module in NumPy. It allows local users to write to arbitrary files by exploiting a symlink attack on a temporary file. This means that an attacker with local access to the system can manipulate the file system and potentially overwrite sensitive files or inject malicious code into them. The impact of this vulnerability can range from unauthorized access to data loss or system compromise.
How To Fix
Latest published version: 2.5.4 as of 23 Oct 2026
pip install --upgrade "numpy==2.5.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.1
This is the first release that contains the fix.
pip install --upgrade "numpy==1.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of NumPy is not immediately feasible, you can implement the following workaround to mitigate the risk:
Avoid running untrusted code or granting unnecessary permissions to users with access to the vulnerable system. Additionally, ensure that the temporary file used by NumPy is not accessible to untrusted users or processes.
Conclusion
In conclusion, the vulnerability CVE-2014-1858 in NumPy allows local users to perform arbitrary file write operations. To mitigate this vulnerability, it is recommended to upgrade to NumPy version 1.8.1 or later. Alternatively, you can follow the provided workaround to reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python package that provides support for large, multi-dimensional arrays and matrices, along with mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis.
The vulnerability allows local users to write to arbitrary files, potentially leading to unauthorized access, data loss, or system compromise.
You can fix this vulnerability by upgrading to NumPy version 1.8.1 or later. Alternatively, you can implement the provided workaround to mitigate the risk.
Yes, you can mitigate the risk by avoiding running untrusted code and ensuring that the temporary file used by NumPy is not accessible to untrusted users or processes.
You can find more information about this vulnerability in the official NumPy documentation or by referring to the CVE identifier CVE-2014-1858.
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
