CVE-2026-18286
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Vulnerability in the aeon library in the load_human_activity_segmentation_datasets method allows remote code execution via Python code injection. Lack of string validation before using it to execute code. User interaction is required.
Risk Assessment
An attacker can execute arbitrary code in the context of the current process, potentially leading to system compromise or data leakage.
Recommendation
Update the aeon library to the latest version and avoid processing untrusted input.
Other vulnerabilities in aeon
See all- CVE-2026-18287High
Vulnerability in the aeon library in the load_time_series_segmentation_benchmark method allows remote code execution via Python code injection. Lack of string validation before using it to execute code. User interaction is required.
- CVE-2026-18285High
Vulnerability in the Aeon library in the load_rehab_pile_dataset method allows remote code execution via deserialization of untrusted data. Lack of user data validation leads to deserialization of untrusted objects. User interaction is required.
Original NVD description (English source)
Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_human_activity_segmentation_datasets method. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29160.