Aeon RCE Flaw in Benchmark Loading: The Risk Lies in the Datasets

Trend Micro's Zero Day Initiative published advisory ZDI-26-470 assigning CVE-2026-18287 to a code injection vulnerability in the Python time-series library aeon. The flaw resides in the `load_time_series_segmentation_benchmark` method and allows remote code execution when a victim loads malicious data. The vendor released a fix after five months of coordinated disclosure. The severity extends beyond the single bug to how ML pipelines treat datasets as passive, implicitly trusted inputs.

On July 29, 2026, the Trend Micro Zero Day Initiative published advisory ZDI-26-470, assigning CVE-2026-18287 to a code injection vulnerability in the Python library aeon, which specializes in time-series algorithms. The flaw resides in the load_time_series_segmentation_benchmark method and allows remote arbitrary code execution when a victim loads malicious data. The vendor released a patch after five months of coordinated disclosure. The criticality lies not only in the bug itself, but in how machine learning pipelines treat datasets as passive, implicitly trusted inputs.

Key Takeaways

Vulnerability CVE-2026-18287 affects the load_time_series_segmentation_benchmark method in the Python time-series library aeon
The root cause is the lack of validation of a user-supplied string before using it to execute Python code
Exploitation requires user interaction: the victim must visit a malicious page or open a malicious file
aeon has released a patch; the CVE-2026-18287 record is reserved but not yet populated with technical details

The Vulnerable Method: When the Benchmark Executes Code Without Filters

According to the ZDI advisory, "the specific flaw exists within the load_time_series_segmentation_benchmark method. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code." The method, part of aeon's benchmark module, loads datasets for time-series segmentation. Under normal conditions it processes structured data files; in the vulnerable configuration, an attacker-controlled string is passed directly to a Python execution mechanism.

The advisory specifies that "an attacker can leverage this vulnerability to execute code in the context of the current process." This means the malicious code runs with the permissions of the Python process that invoked the method, without need for additional escalation. The execution context is the development environment or pipeline where aeon is installed: Jupyter notebooks, batch scripts, data processing services, or inference containers.

The attack vector, as documented by ZDI, requires that "the target must visit a malicious page or open a malicious file." This is not a fully automatic compromise, but a chain that exploits user behavior or an automated system that downloads and processes datasets from external sources.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon." — ZDI Advisory ZDI-26-470

Five Months of Disclosure: The Coordination Timeline

The vulnerability was reported to the vendor on February 19, 2026. Coordinated public release occurred on July 29, 2026, after approximately five months. ZDI does not publish the identity of the researcher who discovered the flaw. The advisory confirms that "aeon has issued an update to correct this vulnerability" but does not provide a direct URL to the patch or list specific affected versions.

The CVE-2026-18287 record, verified on cve.org, shows a "reserved" status: the identifier has been assigned, but technical details are not yet populated. This creates a window where the CVE exists as an official reference but provides no standalone information beyond the ZDI advisory. This is not unusual for coordinated disclosure, but it complicates automated vulnerability scanning for tools that rely solely on the MITRE database.

ZDI is the vulnerability research division of Trend Micro, operating since 2005 with a bug purchasing and coordination program. Advisory ZDI-26-470 falls within this flow: structured, with a timeline, but selective in full technical payload details. The dossier does not specify whether the flaw has been publicly replicated or if PoCs are in circulation.

The Hidden Supply Chain of ML Datasets

The technical reading of the aeon case broadens to a structural problem. Machine learning libraries load datasets from public repositories, shared URLs, downloaded notebooks, or third-party S3 buckets. The code injection pattern documented in ZDI-26-470 shows this implicit chain of trust is an active attack vector, not a hypothetical one.

The load_time_series_segmentation_benchmark method is not an exotic entry point: it belongs to the benchmark module, so it is designed to be invoked when users evaluate algorithms, reproduce papers, or run automated test pipelines. These are exactly the contexts where data comes from diverse and changing sources. A GitHub repository with a "clean" dataset can be forked with an altered file; a link in a tutorial can be replaced; a Colab notebook can download data from a compromised domain.

The ZDI advisory does not describe specific attack scenarios beyond the generic "visit page/open file" vector. The dossier does not document whether the flaw is exploitable via direct remote loading or always requires a social engineering step. However, the combination of "code injection" and "user interaction required" is sufficient to classify the risk as high for environments where data scientists run code from shared notebooks without isolation.

What to Do Now

Verify whether aeon installations in your infrastructure process datasets from uncontrolled external sources
Check the installed aeon version against the vendor update cited in advisory ZDI-26-470
Isolate execution of notebooks or scripts that load aeon benchmarks in environments without direct access to sensitive data or production
Monitor the population of the CVE-2026-18287 record on cve.org for eventual publication of technical details and CVSS vector

Frequently Asked Questions

Which aeon versions are affected?

The ZDI advisory does not specify affected versions. The dossier does not document this information.

Is there a CVSS score for this vulnerability?

No. The ZDI advisory does not publish a CVSS score or scoring vector. The CVE-2026-18287 record is reserved but not populated.

Does the vulnerability require special privileges to exploit?

No, it requires user interaction: the victim must visit a malicious page or open a malicious file. No prior privileges are necessary according to the advisory.

The ZDI-26-470 case falls into a category of bugs that security platforms are mapping belatedly: not vulnerabilities in the machine learning model itself, but in the infrastructure surrounding it. Data loading is the most mundane and most overlooked point in the pipeline. aeon is not an isolated case; it is a wake-up call on how Python scientific libraries handle external input. Proper dataset sanitization is not yet a standard requirement in ML library security reviews, and this advisory shows why it should be.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references