Zurich Instruments LabOne Q contains a critical insecure deserialization vulnerability that allows attackers to execute arbitrary code via malicious experiment files.

The software fails to validate class names during the deserialization of experiment files, allowing an attacker to instantiate arbitrary Python classes. This flaw requires user interaction, specifically the opening of a malicious file, but functions without authentication to trigger the underlying code execution.

Successful exploitation of this vulnerability leads to arbitrary code execution in the context of the user running the Python process, potentially resulting in full system compromise. Given the CVSS score of 7.8, this represents a high-severity risk to research integrity and data confidentiality, as malicious files shared in collaborative environments could be weaponized to compromise local workstations or analysis servers.

Immediate Action: Update the LabOne Q package immediately to version 26.1.2 or 26.4.0 or later using the command pip install --upgrade laboneq.

Proactive Monitoring: Monitor system logs for unexpected Python process behavior or unauthorized file system access originating from the LabOne Q application environment.

Compensating Controls: Restrict the sharing of experiment files to trusted sources only, and implement endpoint detection and response (EDR) solutions to identify and block suspicious child processes spawned by the Python interpreter.

Public Exploit Available: No (exploit_available: false)

The vulnerability in LabOne Q poses a significant risk to laboratory infrastructure and research data. Administrators should prioritize the deployment of the provided security updates across all affected systems. Until patching is completed, users must exercise extreme caution when importing experiment files from external or untrusted collaborators.