CVE-2024-37064

HIGH

Pypi Ydata-profiling - Insecure Deserialization

Title source: rule

Description

Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded.

References (1)

[Various Sources] https://hiddenlayer.com/sai-security-advisory/ydata-june2024

Scores

CVSS v3 7.8

EPSS 0.0019

EPSS Percentile 40.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status draft

Affected Products (1)

pypi/ydata-profiling PyPI

Timeline

Published Jun 04, 2024

Tracked Since Feb 18, 2026