CVE-2026-120499

Name of the Vulnerable Software and Affected Versions h5io versions prior to 0.2.6

Description A code injection issue exists in the read hdf5() function that allows the execution of arbitrary code via a specially crafted HDF5 file. This can be achieved by storing Python code in a node titled timezone, which is processed by the triage read() function using eval() with accessible builtins. Additionally, attackers can specify an arbitrary module in class or custom-object nodes that the import class() function imports, or include pickled objects in pd dataframe or pd series nodes that are deserialized by pandas during the read process.

Recommendations Update h5io to version 0.2.6 or later.