The uproot library is susceptible to arbitrary code execution when processing untrusted ROOT files, posing a high risk to local systems.

The software dynamically generates and compiles Python code based on TStreamerInfo metadata (CWE-94), which can be manipulated by an attacker to achieve remote or local code execution with the privileges of the user running the process.

With a CVSS score of 7.8, this vulnerability represents a high risk to data processing environments. If an attacker can provide a maliciously crafted ROOT file to a victim, they could gain full control over the local execution environment, leading to data exfiltration or system compromise.

Immediate Action: Restrict the processing of ROOT files to only those from trusted and verified sources until a patch is applied by the maintainers.

Proactive Monitoring: Monitor system processes for unusual child processes or unexpected code execution events originating from the Python interpreter during data analysis tasks.

Compensating Controls: Execute untrusted data analysis tasks within a sandboxed environment or a container with minimal privileges to limit the impact of a potential compromise.

Public Exploit Available: Unknown

Users of the uproot library should exercise extreme caution when handling external or untrusted data files. It is recommended to monitor the official scikit-hep repository for security patches and apply them as soon as they become available.