{"vulnerability": "cve-2026-9147", "sightings": [{"uuid": "90083391-4e3d-4c76-9972-7f55e659e633", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91470", "type": "seen", "source": "https://bsky.app/profile/jakebailey.dev/post/3mdya4u3z4k2h", "content": "", "creation_timestamp": "2026-02-03T20:45:38.575320Z"}, {"uuid": "4f07f2da-8318-40c1-a97e-48e493fa49f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91470", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mdytbxfvo426", "content": "", "creation_timestamp": "2026-02-04T02:28:31.663036Z"}, {"uuid": "ab6cdb59-1ab6-456d-a5f4-7513cf294b9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9147", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116941221213811825", "content": "scikit-hep uproot has a HIGH-severity code injection flaw (CVE-2026-9147, CVSS 8.5). Malicious ROOT files can trigger arbitrary Python code execution. Avoid untrusted files until fixed. Full details: https://radar.offseq.com/threat/cve-2026-9147-improper-control-of-generation-of-code-code-injection-in-scikit-hep-uproot-a352d097ded08c6a #OffSeq #Vulnerability #Python #ThreatIntel", "creation_timestamp": "2026-07-18T13:30:27.989896Z"}, {"uuid": "a1ab318b-e6ae-465a-aa5f-c16678a032d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9147", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqweqn3ya72g", "content": "scikit-hep uproot HIGH-severity bug (CVE-2026-9147): Crafted ROOT files can inject code, risking app takeover. Don\u2019t process untrusted files \u2014 check for patches. https://radar.offseq.com/threat/cve-2026-9147-improper-control-of-generation-of-code-code-injection-in-scikit-hep-uproot-a352d097ded08c...", "creation_timestamp": "2026-07-18T13:30:30.162619Z"}, {"uuid": "6aa25551-d2f1-4dd1-a0bd-58946848fff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwggknxnc22", "content": "\ud83d\udfe0 CVE-2026-9147 - High (7.8)\n\nuproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-9147/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-18T14:00:39.165295Z"}, {"uuid": "95ad319d-2733-405b-9adc-f5dc3590d93c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr2jefbppl2e", "content": "Daily IT Security Digest \u2014 2026-07-20\nhttps://dailytexasnews.bsky.social, https://shepherdgazette.bsky.social\n\n7. **scikit-hep uproot \u2014 Code Injection via Malicious ROOT Files (CVE-2026-9147)**\n   The scikit-hep uproot package contains a HIGH-severity code injection vulnerability (CVSS 8.5) where", "creation_timestamp": "2026-07-20T05:03:45.915388Z"}, {"uuid": "7bc6bbaa-31ee-4ac8-be36-21d592ce3bcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr4zrhbv6o27", "content": "Daily IT Security Digest \u2014 2026-07-21\nInjection (CVE-2026-9147, CVSS 8.5)**\nA high-severity code injection flaw has been discovered in the Python `scikit-hep uproot` library. Malicious ROOT files can trigger arbitrary Python code execution, posing a significant risk to data scientists and", "creation_timestamp": "2026-07-21T05:02:43.658109Z"}, {"uuid": "3210ba2d-4d6f-478d-b068-be6cc5c41039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr4zrhkg3w2u", "content": "Daily IT Security Digest \u2014 2026-07-21\nthis toolkit. Users are advised to avoid processing untrusted ROOT files until a patch is released. [Source](https://radar.offseq.com/threat/cve-2026-9147) | [Mastodon](https://infosec.exchange/@offseq/116941221213811825)", "creation_timestamp": "2026-07-21T05:02:44.146218Z"}, {"uuid": "d924a435-c074-4154-9729-0f1d396b5d38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr7kcto63n2w", "content": "Daily IT Security Digest \u2014 2026-07-22\nhttps://mastodon.social/@Analyst207/116732756276891823, https://mastodon.social/@hermes71.bsky.social\n\n## 6. scikit-hep `uproot` Package Contains Malicious Code (CVE-2026-9147)\nThe Python scientific computing package `uproot` (published under scikit-hep on", "creation_timestamp": "2026-07-22T05:04:06.506155Z"}, {"uuid": "5114f993-246b-4bb4-a254-61663f374499", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9147", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr7kctwzem23", "content": "Daily IT Security Digest \u2014 2026-07-22\nfound to contain high-severity malicious code injecting arbitrary Python execution via crafted ROOT files \u2014 a critical supply-chain attack vector for physics and data science workflows. CVE-2026-9147 scores CVSS 8.5 as malicious ROOT files can trigger arbitrary", "creation_timestamp": "2026-07-22T05:04:07.221593Z"}]}