Uproot Code Injection Vulnerability via TStreamerInfo Metadata

A code injection vulnerability exists in Uproot versions through 5.7.4. This issue arises because Uproot generates Python class source code from ROOT TStreamerInfo records and compiles it at runtime. Some metadata fields, such as streamer element names, are interpolated into the generated Python code without proper escaping. An attacker can exploit this by crafting a ROOT file that includes disruptive Python expressions in the metadata. When Uproot processes the file and calls the corresponding reader method, the injected code is executed in the application's context, leading to arbitrary code execution.

Impact

Exploitation of this vulnerability allows for arbitrary Python code execution in applications that use Uproot to process attacker-controlled ROOT files.

Reproduction

To reproduce this vulnerability, create a ROOT file that includes Python expression-breaking content in the TStreamerInfo metadata, such as streamer element names. Then, use Uproot to open the file and access the affected code paths, which will trigger the execution of the injected Python code.

Remediation

Users can upgrade to Uproot version 5.7.5 or later to address this vulnerability.