CVE-2023-47248

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.

• CWE-502

• https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecfPatch
• https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7nMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL/
• https://pypi.org/project/pyarrow-hotfix/Product
• https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecfPatch
• https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7nMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL/
• https://pypi.org/project/pyarrow-hotfix/Product

Published

Nov 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47242Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-47243Cross-Site Request Forgery (CSRF) vulnerability in CodeMShop…8.8
• CVE-2023-47244Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2023-47245Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-47246In SysAid On-Premise before 23.3.36, a path traversal vulner…9.8
• CVE-2023-47247In SysAid On-Premise before 23.3.34, there is an edge case i…4.3
• CVE-2023-47249In International Color Consortium DemoIccMAX 79ecb74, a CIcc…6.5
• CVE-2023-4725The Simple Posts Ticker WordPress plugin before 1.1.6 does n…4.8
• CVE-2023-47250In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro…8.8
• CVE-2023-47251In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro…6.5
• CVE-2023-47252An issue was discovered in PnpSmm in Insyde InsydeH2O with k…6.3
• CVE-2023-47253Qualitor through 8.20 allows remote attackers to execute arb…9.8