CVE-2026-9147 in uproot
Summary
by MITRE • 07/18/2026
uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source without safe quoting via repr() or the !r format specifier. An attacker who can supply a crafted ROOT file can place Python expression-breaking content into a streamer metadata field. When uproot generates and invokes the corresponding reader method, the injected Python expression is evaluated in the context of the process opening the file, resulting in arbitrary Python code execution in applications that open or process attacker-controlled ROOT files with affected uproot code paths.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/30/2026
This vulnerability exists within the uproot library's dynamic code generation mechanism that processes ROOT TStreamerInfo records from binary files. The flaw stems from insufficient sanitization of metadata fields during the runtime code compilation process, creating a path for arbitrary code execution when processing untrusted input. The vulnerability manifests specifically in how streamer element names and other metadata are interpolated into generated Python source code without proper escaping mechanisms such as repr() or the !r format specifier. This design oversight creates a direct injection vector where malicious content within file-controlled fields can break out of their intended context and execute as part of the generated Python code.
The technical exploitation occurs through careful crafting of ROOT files containing specially formatted metadata that, when processed by uproot's dynamic class generation system, results in executable Python code being injected into the generated source. The vulnerability is particularly dangerous because it operates at runtime during file processing, meaning that any application using uproot to open or process files can become compromised. When the affected code path executes, the injected Python expressions are evaluated within the context of the process opening the file, potentially allowing full control over the target system. This represents a classic code injection vulnerability that leverages the dynamic nature of the library's implementation.
The operational impact extends beyond simple code execution to encompass potential system compromise and data exfiltration capabilities for attackers who can supply malicious ROOT files. Applications that rely on uproot for processing scientific data, particularly those in research environments or scientific computing frameworks, become vulnerable to remote code execution attacks. The vulnerability affects any process using uproot's streamer info handling functionality when processing potentially malicious input files, creating a broad attack surface across various scientific computing applications and workflows. This makes the vulnerability particularly concerning for organizations that handle untrusted data inputs or operate in environments where file integrity cannot be guaranteed.
Security mitigations should focus on implementing proper input sanitization and escaping mechanisms during the dynamic code generation process. The most effective immediate fix involves ensuring all metadata fields are properly quoted using repr() or equivalent escaping techniques before interpolation into generated Python source code. Additionally, applications should implement strict file validation and sandboxing measures when processing external ROOT files, including runtime environment restrictions and privilege separation where possible. Organizations should also consider implementing input validation at multiple layers, including file format verification and content analysis, to prevent malicious data from reaching the vulnerable code paths. This vulnerability aligns with CWE-94 (Improper Control of Generation of Code) and maps to ATT&CK technique T1059.006 (Python) for execution via Python-based injection attacks, highlighting the need for both defensive coding practices and runtime protection mechanisms.