Skip to content
OpenAdvisories

Product · scikit-hep

uproot

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.8
    CVE-2026-9147 Public exploit

    uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata

    uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source w…

    scikit-hep uproot