{"id":"CVE-2023-47248","aliases":["CLSA-2026-1778805964","EUVD-2023-0212","GHSA-5wvp-7f3h-6wmm","PYSEC-2023-238","ROOT-APP-PYPI-CVE-2023-47248","openSUSE-SU-2024:13431-1","openSUSE-SU-2024:13460-1","openSUSE-SU-2024:13480-1","openSUSE-SU-2026:11341-1","openSUSE-SU-2026:11616-1"],"status":"published","title":"PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file","description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\n\nThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\n\nIf it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.14528,"percentile":0.96663,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2023-11-09T08:17:08Z","modified":"2026-10-28T02:31:05Z","exploits":[{"source":"nuclei","id":"CVE-2023-47248","title":"PyArrow Flight RPC - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47248.yaml"},{"source":"pocgithub","id":"Prodigysec/pyarrow-CVE-2023-47248","title":"Prodigysec/pyarrow-CVE-2023-47248","date":"2025-12-27","url":"https://github.com/Prodigysec/pyarrow-CVE-2023-47248"}],"fixes":[{"ecosystem":"PyPI","package":"pyarrow","fixed_in":["14.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"pyarrow","fixed_in":["12.0.1.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"pyarrow","fixed_in":["6.0.1+aikido.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-pandas","fixed_in":["3.0.3-1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-geopandas","fixed_in":["1.1.4-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyarrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.14.0"},{"fixed":"14.0.1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pyarrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.1"},{"fixed":"12.0.1.post1+tuxcare"}]}],"versions":["12.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"pyarrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.14.0"},{"fixed":"14.0.1"}]}],"versions":["0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.17.0","0.17.1","1.0.0","1.0.1","10.0.0","10.0.1","11.0.0","12.0.0","12.0.1","13.0.0","14.0.0","2.0.0","3.0.0","4.0.0","4.0.1","5.0.0","6.0.0","6.0.1","7.0.0","8.0.0","9.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"pyarrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.14.0"},{"fixed":"14.0.1"}]}],"versions":["0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.17.0","0.17.1","1.0.0","1.0.1","10.0.0","10.0.1","11.0.0","12.0.0","12.0.1","13.0.0","14.0.0","2.0.0","3.0.0","4.0.0","4.0.1","5.0.0","6.0.0","6.0.1","7.0.0","8.0.0","9.0.0"]},{"source":"osv","ecosystem":"Root:PyPI","package":"pyarrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1+aikido.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-1.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-1.1"}]}]}],"products":[{"vendor":"apache","product":"pyarrow"},{"vendor":"apache software foundation","product":"pyarrow"}],"references":[{"url":"https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf","tags":["patch","x_transferred","Patch","fix","web"]},{"url":"https://pypi.org/project/pyarrow-hotfix/","tags":["mitigation","x_transferred","Product","package","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47248","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5wvp-7f3h-6wmm","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2023-238.yaml","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47248","tags":["web","advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2023/11/08/7","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL","tags":["web"]},{"url":"https://pypi.org/project/pyarrow-hotfix","tags":["web"]},{"url":"https://conda-forge.org/","tags":["web"]},{"url":"https://pypi.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47248.json","tags":["advisory"]},{"url":"https://github.com/apache/arrow","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47248","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-47248","title":"PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file","description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\n\nThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\n\nIf it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions.","status":"published","published":"2023-11-09T08:17:08.431Z","modified":"2025-02-13T17:17:56.649Z","cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:14.298866Z"}],"euvd":[{"id":"EUVD-2023-0212","description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\n\nThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\n\nIf it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions.","status":"published","published":"2023-11-09T08:17:08Z","modified":"2025-02-13T17:17:56Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-03T00:03:48.562419Z"}],"ghsa":[{"id":"GHSA-5wvp-7f3h-6wmm","title":"PyArrow: Arbitrary code execution when loading a malicious data file","description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\n\nThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\n\nIf it is not possible to upgrade, maintainers provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/  for instructions.","status":"published","published":"2023-11-09T09:30:26Z","modified":"2024-10-21T20:52:57Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2023-47248","description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\n\nThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\n\nIf it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions.","status":"published","published":"2023-11-09T09:15:08.223Z","modified":"2026-06-17T06:32:27.77Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"GHSA-5wvp-7f3h-6wmm","title":"PyArrow: Arbitrary code execution when loading a malicious data file","description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\n\nThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\n\nIf it is not possible to upgrade, maintainers provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/  for instructions.","status":"published","published":"2023-11-09T09:30:26Z","modified":"2026-09-10T03:50:04.164494775Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"ROOT-APP-PYPI-CVE-2023-47248","title":"CVE-2023-47248 in pyarrow - Patched by Root","description":"Root has patched CVE-2023-47248 in the pyarrow package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-23T15:16:17Z","modified":"2026-10-23T16:15:16.842682068Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"CLSA-2026-1778805964","title":"TuxCare security update for pyarrow (1 CVE)","description":"TuxCare rebuilt pyarrow to address 1 CVE. Fixed in 12.0.1.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:48:00.989594412Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CVE-2023-47248","title":"PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file","description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).\n\nThis vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nIt is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.\n\nIf it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See  https://pypi.org/project/pyarrow-hotfix/  for instructions.","status":"published","published":"2023-11-09T08:17:08.431Z","modified":"2026-10-28T02:31:05.63353513Z","cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"openSUSE-SU-2024:13431-1","title":"python310-pyarrow-14.0.1-2.1 on GA media","description":"These are all security issues fixed in the python310-pyarrow-14.0.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:41.421856Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13460-1","title":"python310-geopandas-0.14.1-1.1 on GA media","description":"These are all security issues fixed in the python310-geopandas-0.14.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:51.13721Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13480-1","title":"python310-pandas-2.1.3-1.1 on GA media","description":"These are all security issues fixed in the python310-pandas-2.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:44.846091Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11341-1","title":"python313-pandas-3.0.3-1.2 on GA media","description":"These are all security issues fixed in the python313-pandas-3.0.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-22T00:00:00Z","modified":"2026-07-23T09:45:09.301587173Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11616-1","title":"python313-geopandas-1.1.4-1.1 on GA media","description":"These are all security issues fixed in the python313-geopandas-1.1.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T11:01:50.209972117Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2023-238","description":"Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).","status":"published","published":"2023-11-17T17:41:59Z","modified":"2023-11-20T09:26:47.189113Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}