CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source without safe quoting via repr() or the !r format specifier. An attacker who can supply a crafted ROOT file can place Python expression-breaking content into a streamer metadata field. When uproot generates and invokes the corresponding reader method, the injected Python expression is evaluated in the context of the process opening the file, resulting in arbitrary Python code execution in applications that open or process attacker-controlled ROOT files with affected uproot code paths.

• CWE-94

• https://github.com/scikit-hep/uproot5
• https://github.com/scikit-hep/uproot5/commit/c045c2824295d907d2e705f31110c742928e50e7
• https://github.com/scikit-hep/uproot5/security/advisories/GHSA-6946-mq52-g438
• https://www.vulncheck.com/advisories/uproot-and-before-code-injection-via-tstreamerinfo-metadata

Published

Jul 18, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9140A denial-of-service security issue exists in the 1719-AENTR.…8.7
• CVE-2026-9141Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…9.8
• CVE-2026-9142There is an insecure default credentials vulnerability in NI…9.3
• CVE-2026-9143There is an incorrect conversion between numeric types vulne…5.3
• CVE-2026-9144Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contain…8.4
• CVE-2026-9145The Database for Contact Form 7, WPforms, Elementor forms pl…6.5
• CVE-2026-9148The Comments – wpDiscuz plugin for WordPress is vulnerable t…7.2
• CVE-2026-9149A flaw was found in libsolv. This heap buffer overflow vulne…6.5
• CVE-2026-9150A flaw was found in libsolv. This stack-based buffer overflo…6.5
• CVE-2026-9151An OS command injection vulnerability exists in the VPN modu…8.5
• CVE-2026-9152A missing authentication vulnerability exists in the Altium …10
• CVE-2026-9153Arbitrary File Read vulnerability in Rapid7 InsightConnect S…6.5