{"vulnerability": "CVE-2026-9147", "sightings": [{"uuid": "90083391-4e3d-4c76-9972-7f55e659e633", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91470", "type": "seen", "source": "https://bsky.app/profile/jakebailey.dev/post/3mdya4u3z4k2h", "content": "", "creation_timestamp": "2026-02-03T20:45:38.575320Z"}, {"uuid": "4f07f2da-8318-40c1-a97e-48e493fa49f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91470", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mdytbxfvo426", "content": "", "creation_timestamp": "2026-02-04T02:28:31.663036Z"}, {"uuid": "2a1ead71-837d-426b-82ac-8d9fceb95093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2J_sYTarvuZL8", "content": "", "creation_timestamp": "2026-08-17T18:00:06.284343Z"}, {"uuid": "70eecc9a-2d69-41b9-bda1-18da6f70a16f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "Telegram/grGgFPZ83MCjoN4lsKRGKPYRhb0kdh5D59BuMU6s61_TMsM", "content": "", "creation_timestamp": "2026-08-17T18:00:05.752922Z"}, {"uuid": "d5d7656e-51eb-4443-9c17-42920790ab5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "published-proof-of-concept", "source": "Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2J_sYTarvuZL8", "content": "", "creation_timestamp": "2026-08-18T00:00:10.104252Z"}, {"uuid": "d2faa4de-e7d0-410f-9a74-65096c2be456", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "published-proof-of-concept", "source": "Telegram/grGgFPZ83MCjoN4lsKRGKPYRhb0kdh5D59BuMU6s61_TMsM", "content": "", "creation_timestamp": "2026-08-18T00:00:10.487085Z"}, {"uuid": "9d564912-69d4-4ccd-b8b4-b2f5c850d1ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://t.me/GithubRedTeam/98238", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9147-uproot-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SaiTeja-Erukude\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 21:58:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nuproot <= 5.7.4 code injection via unsafe Python source generation from ROOT TStreamerInfo metadata.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:09.849419Z"}, {"uuid": "ab6cdb59-1ab6-456d-a5f4-7513cf294b9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9147", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116941221213811825", "content": "scikit-hep uproot has a HIGH-severity code injection flaw (CVE-2026-9147, CVSS 8.5). Malicious ROOT files can trigger arbitrary Python code execution. Avoid untrusted files until fixed. Full details: https://radar.offseq.com/threat/cve-2026-9147-improper-control-of-generation-of-code-code-injection-in-scikit-hep-uproot-a352d097ded08c6a #OffSeq #Vulnerability #Python #ThreatIntel", "creation_timestamp": "2026-07-18T13:30:27.989896Z"}, {"uuid": "a1ab318b-e6ae-465a-aa5f-c16678a032d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9147", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqweqn3ya72g", "content": "scikit-hep uproot HIGH-severity bug (CVE-2026-9147): Crafted ROOT files can inject code, risking app takeover. Don\u2019t process untrusted files \u2014 check for patches. https://radar.offseq.com/threat/cve-2026-9147-improper-control-of-generation-of-code-code-injection-in-scikit-hep-uproot-a352d097ded08c...", "creation_timestamp": "2026-07-18T13:30:30.162619Z"}, {"uuid": "6aa25551-d2f1-4dd1-a0bd-58946848fff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwggknxnc22", "content": "\ud83d\udfe0 CVE-2026-9147 - High (7.8)\n\nuproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-9147/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-18T14:00:39.165295Z"}, {"uuid": "a3f7dafa-3701-4535-bed4-7d2fbc010b0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://t.me/GithubRedTeam/98238", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9147-uproot-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SaiTeja-Erukude\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 21:58:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nuproot <= 5.7.4 code injection via unsafe Python source generation from ROOT TStreamerInfo metadata.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:33.292635Z"}, {"uuid": "95ad319d-2733-405b-9adc-f5dc3590d93c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr2jefbppl2e", "content": "Daily IT Security Digest \u2014 2026-07-20\nhttps://dailytexasnews.bsky.social, https://shepherdgazette.bsky.social\n\n7. **scikit-hep uproot \u2014 Code Injection via Malicious ROOT Files (CVE-2026-9147)**\n   The scikit-hep uproot package contains a HIGH-severity code injection vulnerability (CVSS 8.5) where", "creation_timestamp": "2026-07-20T05:03:45.915388Z"}, {"uuid": "7bc6bbaa-31ee-4ac8-be36-21d592ce3bcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr4zrhbv6o27", "content": "Daily IT Security Digest \u2014 2026-07-21\nInjection (CVE-2026-9147, CVSS 8.5)**\nA high-severity code injection flaw has been discovered in the Python `scikit-hep uproot` library. Malicious ROOT files can trigger arbitrary Python code execution, posing a significant risk to data scientists and", "creation_timestamp": "2026-07-21T05:02:43.658109Z"}, {"uuid": "3210ba2d-4d6f-478d-b068-be6cc5c41039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr4zrhkg3w2u", "content": "Daily IT Security Digest \u2014 2026-07-21\nthis toolkit. Users are advised to avoid processing untrusted ROOT files until a patch is released. [Source](https://radar.offseq.com/threat/cve-2026-9147) | [Mastodon](https://infosec.exchange/@offseq/116941221213811825)", "creation_timestamp": "2026-07-21T05:02:44.146218Z"}, {"uuid": "d924a435-c074-4154-9729-0f1d396b5d38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr7kcto63n2w", "content": "Daily IT Security Digest \u2014 2026-07-22\nhttps://mastodon.social/@Analyst207/116732756276891823, https://mastodon.social/@hermes71.bsky.social\n\n## 6. scikit-hep `uproot` Package Contains Malicious Code (CVE-2026-9147)\nThe Python scientific computing package `uproot` (published under scikit-hep on", "creation_timestamp": "2026-07-22T05:04:06.506155Z"}, {"uuid": "5114f993-246b-4bb4-a254-61663f374499", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr7kctwzem23", "content": "Daily IT Security Digest \u2014 2026-07-22\nfound to contain high-severity malicious code injecting arbitrary Python execution via crafted ROOT files \u2014 a critical supply-chain attack vector for physics and data science workflows. CVE-2026-9147 scores CVSS 8.5 as malicious ROOT files can trigger arbitrary", "creation_timestamp": "2026-07-22T05:04:07.221593Z"}, {"uuid": "8950dc82-0004-4642-88fb-ea5ae2695bb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98238", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-9147-uproot-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SaiTeja-Erukude\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 21:58:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nuproot <= 5.7.4 code injection via unsafe Python source generation from ROOT TStreamerInfo metadata.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T00:00:10.185590Z"}]}