Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N N P H H H 8.5 .0022 11.8 —
AFFECTED Product Versions Fixed uproot unspecified —
TIMELINE May 20 Reserved by VulnCheck Jul 18 Published (CNA: VulnCheck) Aug 28 EXPLOIT PUBLISHED — CVE-2026-9147 (scikit-hep uproot). Public exploit reference added.
uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source without safe quoting via repr() or the !r format specifier. An attacker who can supply a crafted ROOT file can place Python expression-breaking content into a streamer metadata field. When uproot generates and invokes the corresponding reader method, the injected Python expression is evaluated in the context of the process opening the file, resulting in arbitrary Python code execution in applications that open or process attacker-controlled ROOT files with affected uproot code paths.
| Date | Event | Detail |
|---|---|---|
| May 20, 2026 | Reserved | Reserved by VulnCheck |
| July 18, 2026 | Published | Published (CNA: VulnCheck) |
| August 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-9147 (scikit-hep uproot). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| scikit-hep | uproot | — | — | — |
Authoritative record: CVE-2026-9147 at cve.org
Vendors: scikit-hep
Weaknesses: CWE-94
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-9147 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
