CVE-2026-18285
Received Received - Intake

Remote Code Execution in Aeon load_rehab_pile_dataset

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_rehab_pile_dataset method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28749.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18285
EUVD
EUVD-2026-63433

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
aeon load_rehab_pile_dataset *
aeon load_rehab_pile_dataset From 2026-02-17 (inc) to 2026-07-29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote code execution flaw in Aeon caused by improper validation of user-supplied data in the load_rehab_pile_dataset method. It allows deserialization of untrusted data, which attackers can exploit by tricking users into visiting a malicious page or opening a malicious file to execute arbitrary code in the current process.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of Aeon and inspecting code for unsafe deserialization patterns. Review Python files in aeon/datasets/ for use of eval() or pickle with allow_pickle=True. Check for recent suspicious activity in logs related to dataset loading or code execution.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious code on your system. This could lead to unauthorized access, data theft, or system compromise. Users must interact with a malicious file or page for exploitation, so caution with untrusted inputs is critical.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. For GDPR, it may result in unauthorized processing or access to personal data, violating principles of data protection and user consent. For HIPAA, it could allow unauthorized access to protected health information, compromising confidentiality and integrity requirements.

Mitigation Strategies

Immediately update Aeon to the latest patched version. Remove or replace any code using eval() or unsafe pickle operations in dataset loaders. Disable or restrict access to functions that load untrusted data until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart