## https://sploitus.com/exploit?id=B2F438C4-2CAB-5702-968B-7E556A2A7CDB
# CVE-2026-9147: uproot Code Injection via TStreamerInfo Metadata
**Severity:** High, CVSS 4.0 **8.5**, CVSS 3.1 **7.8** (assigned by VulnCheck, the CNA)
**Vector (v4.0):** `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
**Vector (v3.1):** `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
**Affected:** uproot `<= 5.7.4`
**Tested:** `uproot 5.7.4`
**Fixed in:** `5.7.5` / commit `c045c28`
**CWE:** CWE-94 (Improper Control of Generation of Code, Code Injection); secondary CWE-95 (Eval Injection)
**Reported by:** Sai Teja Erukude
**CNA:** VulnCheck
**Published:** July 18, 2026
---
## Summary
uproot `5.7.4` and prior dynamically generate Python class source from ROOT `TStreamerInfo` metadata and compile it at runtime.
Some file-controlled streamer metadata fields are interpolated into generated Python source without safe quoting. An attacker who can provide a crafted ROOT file can inject Python expression-breaking content into streamer metadata, such as a crafted element name.
When an affected application opens the crafted ROOT file and uproot generates and invokes the corresponding reader method, the injected Python expression can execute in the context of the hosting process.
## Impact
An attacker may execute arbitrary Python code in applications that open or process attacker-controlled ROOT files with affected uproot code paths.
Depending on the application, this can allow:
- Reading or modifying files accessible to the process.
- Accessing environment variables and application secrets.
- Calling internal services reachable from the host.
- Disrupting data-processing jobs or application behavior.
## Technical Detail
The issue is in uproot's generated-source path for ROOT streamer metadata.
The PoC creates a ROOT file containing crafted `TStreamerInfo` metadata for an `ExploitTarget` class. The crafted streamer element name breaks out of the generated expression and injects a benign `pathlib` call.
The reported behavior is:
1. uproot opens the crafted ROOT file.
2. uproot reads file-backed `TStreamerInfo` metadata.
3. uproot generates Python class source for `ExploitTarget`.
4. The generated class source contains the injected expression.
5. Invoking the generated `read_members` method executes the injected expression.
## Proof of Concept
[`root_file_builder.py`](./root_file_builder.py) creates `malicious_tstreamerinfo.root` with crafted streamer metadata.
[`run_poc.py`](./run_poc.py) opens the file with uproot, forces generation of the file-backed `ExploitTarget` class, invokes the generated `read_members` method, and verifies marker-file evidence.
Run in a local test environment only:
```bash
python -m venv .venv
.venv\Scripts\activate
python -m pip install -r requirements.txt
python -B run_poc.py
```
Expected evidence on vulnerable versions:
```text
uproot_version: 5.7.4
file_backed_element_name_contains_payload: True
class_code_contains_injected_pathlib_call: True
expected_exception: True
exception_type: DeserializationError
marker_exists: True
marker_contents:
executed through uproot generated read_members
success: True
```
The payload is intentionally harmless. It only writes this local marker string:
```text
executed through uproot generated read_members
```
It does not spawn a shell, connect to a network service, read secrets, delete data, or modify files outside the PoC directory.
## Remediation
Upgrade to uproot `5.7.5` or later.
If immediate upgrade is not possible:
- Do not process ROOT files from untrusted users.
- Isolate ROOT-file processing jobs with minimal privileges.
- Validate or reject unexpected `TStreamerInfo` metadata before processing.
- Avoid workflows that automatically open uploaded or externally supplied ROOT files.
## Disclosure Timeline
| Date | Event |
|---|---|
| May 20, 2026 | Vulnerability submitted to VulnCheck |
| May 20, 2026 | VulnCheck initiated outreach; `CVE-2026-9147` provisionally allocated |
| July 5, 2026 | uproot `5.7.5` released with patch |
| July 18, 2026 | `CVE-2026-9147` published |
## Credit
Discovered and reported by **Sai Teja Erukude**, coordinated through VulnCheck.
## References
- CVE Record: https://vulners.com/cve/CVE-2026-9147
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9147
- VulnCheck advisory: https://www.vulncheck.com/advisories/uproot-and-before-code-injection-via-tstreamerinfo-metadata
- GitHub advisory: https://github.com/scikit-hep/uproot5/security/advisories/GHSA-6946-mq52-g438
- Patch commit: https://github.com/scikit-hep/uproot5/commit/c045c2824295d907d2e705f31110c742928e50e7
- uproot project: https://github.com/scikit-hep/uproot5