ESPectre analysis tools unsafe deserialization allows code execution
The analysis tools of the ESPectre motion sensing project can let your PC be hacked.
Summary
ESPectre's analysis tools load NPZ dataset files in a way that can run attacker code. Opening a malicious dataset, such as one sent in by a contributor or pull request author, runs code as the maintainer or developer.
Affected when
- Analysis tools loading NPZ datasets with NumPy pickle support enabled
- Opening untrusted datasets (.npz files under micro-espectre/data) with the analysis tools
What to do
Update to 3.0.0-rc1 or later. Until then, do not open datasets of unknown origin with the analysis tools.
Products and platforms
CVE IDs
Times
First published
First seen