CVE-2023-47248 in the critical feed json
PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file
published 2023-11-09 3 y ago modified 2026-09-10 1 mo ago also GHSA-5wvp-7f3h-6wmm , PYSEC-2023-238 , EUVD-2023-0212
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.5%
- EPSS 14.5% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
Patch / fix
- pypi pyarrow 14.0.1
- python-geopandas openSUSE Tumbleweed 1.1.4-1.1
- python-pandas openSUSE Tumbleweed 3.0.3-1.2
opensuse advisories openSUSE-SU-2026:11616-1openSUSE-SU-2026:11341-1
Exploit prediction
14.53% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template PyArrow Flight RPC - Remote Code Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pyarrow | >=0.14.0, <14.0.1 |
14.0.1 |
Affected products
- Apache Software Foundation PyArrow
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf
patch, web
-
pypi.org
/project/pyarrow-hotfix/
mitigation, product, patch
-
lists.apache.org
/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n
vendor-advisory, web, mailing-list, third-party-advisory
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL/
-
nvd.nist.gov
/vuln/detail/CVE-2023-47248
advisory
-
github.com
/advisories/GHSA-5wvp-7f3h-6wmm
advisory
-
github.com
/apache/arrow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2023-238.yaml
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/MAGWEAJDWO2ACYATUQCPXLSYY5C3L3XU
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/MWFYXLVBTBHNKYRXI572RFX7IJDDQGBL
web
-
pypi.org
/project/pyarrow-hotfix
web
-
cve.org
/CVERecord?id=CVE-2023-47248
web, advisory
-
openwall.com
/lists/oss-security/2023/11/08/7
web
Sources
- CVE List CVE-2023-47248
- GitHub Advisory GHSA-5wvp-7f3h-6wmm
- NVD CVE-2023-47248
- OSV PYSEC-2023-238
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.