CVE-2026-9147

Name of the Vulnerable Software and Affected Versions uproot (affected versions not specified)

Description The software dynamically generates Python class source code from ROOT TStreamerInfo records found in a file and compiles it at runtime. Certain streamer metadata fields, such as streamer element names, are interpolated into the generated Python source without safe quoting. This allows an attacker to provide a crafted ROOT file containing Python expression-breaking content within a streamer metadata field. When the software generates and invokes the corresponding reader method, the injected expression is evaluated, leading to arbitrary Python code execution in applications that process the malicious file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.