Aeon RCE via Pickle Dataset: ML Pipeline Risk

CVE-2026-18285: The Python library Aeon executed arbitrary code through pickle deserialization of seemingly legitimate datasets. The bug has been fixed.

On July 29, 2026, the TrendAI Zero Day Initiative published advisory ZDI-26-468 detailing a deserialization vulnerability in the Python library Aeon. The function load_rehab_pile_dataset loaded compressed files via numpy.load() with the parameter allow_pickle=True, enabling remote arbitrary code execution when a victim opened a tampered dataset. The bug, reported to the vendor on February 17 after 162 days of coordinated embargo, exposes a systemic issue in machine learning pipelines: implicit trust in "open" datasets downloaded from external repositories.

Key Takeaways

The vulnerability CVE-2026-18285 resides in Aeon's load_rehab_pile_dataset function, which used np.load(allow_pickle=True) to load compressed datasets.
A remote attacker achieves arbitrary code execution in the context of the current process when the victim opens a malicious file or visits a page that triggers the dataset load.
Private disclosure occurred on February 17, 2026; coordinated public disclosure on July 29, 2026. The CVSS assigned by ZDI is 7.8.
The vendor patch removes the allow_pickle=True parameter from np.load() calls in the vulnerable function, eliminating the arbitrary deserialization attack surface.

The Mechanism: Why allow_pickle=True Is a Trapdoor

The specific flaw, according to the ZDI advisory, "exists within the method load_rehab_pile_dataset. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data." This technical phrasing masks a dangerously simple dynamic: the allow_pickle=True parameter in NumPy delegates to Python the task of reconstructing arbitrary objects from the binary stream, and the pickle protocol executes code during reconstruction.

An attacker who injects a pickle payload into an .npy file or a seemingly valid compressed archive needs no memory exploits or sophisticated techniques. The deserialization itself is the exploit: loading the dataset becomes payload execution. "An attacker can leverage this vulnerability to execute code in the context of the current process," states advisory ZDI-26-468. The victim need only interact with the malicious file, opening it directly or visiting a page that triggers its automatic loading.

The execution context is that of the Python process running the ML pipeline. In development and research environments, where Jupyter notebooks or training scripts often run with local user privileges and access to API keys, cloud credentials, or sensitive corporate datasets, this significantly bounds the potential damage. No authentication or particular network condition is required: the vector is the dataset itself, not a malicious connection to an exposed service.

The Machine Learning Supply Chain as an Attack Vector

The Aeon vulnerability is not an isolated incident. It is the concrete manifestation of a systemic problem running through the entire Python data science ecosystem: pickle deserialization is pervasive, convenient, and architecturally insecure. NumPy, pandas, scikit-learn, and dozens of derivative libraries have faced the same dilemma for years, often opting for deprecation warnings rather than definitive removal of the allow_pickle parameter. The reason is compatibility: historical datasets and legacy pipelines depend on the pickle format, and breaking that compatibility means breaking reproducible research.

The difference with Aeon is the specificity of the context. load_rehab_pile_dataset is a data-loading function for biomedical time series, a domain where public datasets are frequently downloaded automatically from external URLs in benchmark or experiment-reproduction pipelines. The absence of binary format validation before deserialization means a compromised dataset repository, or a malicious mirror, can become a distribution channel for executable code without the end user's awareness.

The patch commit on the vendor's GitHub repository, aeon-toolkit/aeon, explicitly removes allow_pickle=True from np.load() calls for the X and y variables in load_rehab_pile_dataset, replacing them with direct calls without the parameter. This is the correct architectural fix: if the dataset does not require arbitrary Python objects, pickle must not be enabled. The commit also patches related functions — load_time_series_segmentation_benchmark and load_human_activity_segmentation_datasets — but with different mechanisms (removal of eval()), confirming the vendor conducted a broader review of the data-loading perimeter.

"The specific flaw exists within the load_rehab_pile_dataset method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data." — TrendAI Zero Day Initiative Advisory ZDI-26-468

What to Do Now

The documented exposure window spans five months between private disclosure and public disclosure. During this period, unpatched installations remained vulnerable without the community having visibility into the risk. Now that the advisory is public, operators must act on three specific fronts.

Update Aeon immediately if your installation exposes dataset-loading functions to untrusted input. The patch is available in the official repository and removes the attack surface by deserializing the dataset in safe mode.

Verify cached or archived datasets downloaded via load_rehab_pile_dataset or related functions before July 29, 2026. The source does not confirm in-the-wild exploits, but the nature of the vector makes it technically impossible to distinguish a legitimate dataset from a malicious one without deep binary analysis.

Isolate automated ML pipelines that download datasets from external repositories into environments with limited filesystem and credential access. If the architecture permits, perform the initial load in containers or sandboxes without network access or production API keys.

Review transitive dependencies that might reintroduce allow_pickle=True indirectly. NumPy itself retains the parameter for backward compatibility, and other libraries could inherit the same flaw in similar wrapper functions.

What We Still Don't Know

Several aspects remain undocumented in the available brief. It does not emerge whether the vulnerability was actively exploited before the patch: absence of in-the-wild evidence does not equal absence of exploitation, but neither does it confirm it. The exact payload format is not detailed — modified .npy file, reworked compressed archive, or other vector — and this limits the ability to build specific detections. It is unclear whether other Aeon loading functions share the exact same mechanism, though the commit suggests a broader review with differentiated fixes per function family.

The name of the researcher who discovered and reported the vulnerability is not available in the examined sources. The exact date of the GitHub patch commit is not captured by the provided text, although the merge is verified and the correction content is confirmed.

The Systemic Lesson: When the Dataset Becomes Executable

The story of CVE-2026-18285 is less flashy than a zero-day exploit chain in browsers or operating systems, but equally revealing of the trust architecture underpinning contemporary machine learning. Datasets are treated as passive data, containers of examples from which to extract patterns. In reality, the moment a library deserializes them with protocols like pickle, they become executable code with the privileges of the training process.

Aeon's fix — removing allow_pickle=True — is technically trivial, but represents a compatibility break that other maintainers have avoided for years. The vendor's decision to proceed anyway indicates that the risk of remote execution via seemingly innocuous datasets has surpassed the tolerability threshold. For the ML community, the question is whether this will be an exception or the precedent that accelerates a broader review of serialization formats in public data flows.

Information verified against cited sources and current as of publication.

Sources

Sources and references