{"action":"Upgrade pandas to 1.0.4 or later.","affected":[{"fixed":"1.0.4","introduced":"0"}],"component":"pandas","cve_ids":["CVE-2020-13091"],"ecosystem":"PyPI","epss":0.03507,"exploited":false,"fixed_versions":["1.0.4"],"id":"tcs_01M5KGAVFFD619RPPKT71NEEMD","modified_at":"2023-11-08T04:02:12.263851Z","published_at":"2020-05-15T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-73","https://github.com/0FuzzingQ/vuln/blob/master/pandas%20unserialize.md","https://pandas.pydata.org/pandas-docs/stable/reference/api/pandas.read_pickle.html"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-73","url":"https://osv.dev/vulnerability/PYSEC-2020-73"}],"summary":"** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties"}