CVE-2020-13091
- Source
- https://cve.org/CVERecord?id=CVE-2020-13091
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13091.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-13091
- Aliases
- Downstream
- Published
- 2020-05-15T19:15:12.167Z
- Modified
- 2026-07-08T19:44:03.568182Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the readpickle() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the readpickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner
- References
Affected packages
Git / github.com/pandas-dev/pandas
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pandas-dev/pandas
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "source": "CPE_RANGE", "cpe": "cpe:2.3:a:numfocus:pandas:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "last_affected": "1.0.3" } ] }
Affected versions
0.*
0.3.0
v0.*
v0.10.0
v0.10.0b1
v0.10.1
v0.11.0
v0.11.0rc1
v0.12.0
v0.12.0rc1
v0.13.0
v0.13.1
v0.14.0
v0.14.0rc1
v0.14.1
v0.15.0
v0.15.0rc1
v0.15.1
v0.15.2
v0.15.2pre
v0.15pre
v0.16.0
v0.16.0rc1
v0.16.1
v0.16.2
v0.17.0
v0.17.0rc1
v0.17.0rc2
v0.17.1
v0.18.0
v0.18.0rc1
v0.18.0rc2
v0.18.1
v0.19.0
v0.19.0rc1
v0.20.0
v0.20.0rc1
v0.20.0rc2
v0.20.1
v0.21.0
v0.21.0.dev
v0.21.0rc1
v0.22.0.dev0
v0.23.0
v0.23.0.dev0
v0.23.0rc1
v0.23.0rc2
v0.24.0
v0.24.0.dev0
v0.24.0rc1
v0.25.0
v0.25.0.dev0
v0.25.0rc0
v0.26.0.dev0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.8.0
v0.8.0b1
v0.8.0b2
v0.8.0rc1
v0.8.0rc2
v0.9.0
v0.9.0rc1
v0.9.0rc2
v0.9.1
v0.9.1rc1
v1.*
v1.0.0
v1.0.0rc0
v1.0.1
v1.0.2
v1.0.3