CVE-2026-18286: aeon Code injection RCE

CISO Take

A code injection vulnerability in aeon's load_human_activity_segmentation_datasets function allows arbitrary Python code execution when a data scientist opens a malicious file or visits a crafted page that triggers the vulnerable loader — the function passes a user-supplied string into code execution without validation (CWE-94). There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, and the package carries a risk score of 0/100 with unknown downstream dependent counts, so this reads as a low-volume research disclosure (ZDI-CAN-29160) rather than an actively exploited threat. The blast radius is nonetheless real for any ML team using aeon for human activity/time-series segmentation: a single researcher or engineer opening a shared notebook, dataset file, or link that invokes this loader hands an attacker code execution in their environment — potentially a training pipeline or CI runner with broader access. Patch by pulling the fix referenced in the vendor commit (aeon-toolkit/aeon@7519180) and upgrading aeon in all environments that load human activity segmentation datasets; until patched, treat any externally-sourced dataset file or notebook using this loader as untrusted and review/sandbox before execution. Detection should focus on unexpected child processes spawned from Python/Jupyter sessions running aeon rather than network signatures, since exploitation is local/user-driven, not remote-service-facing.

Sources:NVDATLAS

What is the risk?

No CVSS score or EPSS percentile is available, and there is no KEV listing, public exploit, or scanner template, so near-term mass exploitation is unlikely. However, the underlying flaw class — unsanitized user input reaching a code execution sink (CWE-94) — is trivially reliable to exploit once a victim can be induced to trigger the vulnerable function, and user interaction is the only real barrier (no authentication or network exposure required). Risk should be treated as moderate: low probability of opportunistic mass exploitation today, but high severity if a targeted attacker (e.g., via a poisoned shared dataset, tutorial notebook, or research repo) gets a victim to invoke the loader, since impact is full code execution in the current process context.

How does the attack unfold?

Delivery

Attacker crafts a malicious file or link referencing aeon's dataset loader and distributes it via a notebook, repo, or webpage.

AML.T0011.000

User Execution

Victim opens the malicious file or visits the malicious page, invoking load_human_activity_segmentation_datasets with attacker-controlled input.

AML.T0011

Code Injection

The unsanitized, user-supplied string is used by aeon to execute Python code, exploiting CWE-94.

AML.T0050

Impact

Attacker gains arbitrary code execution in the context of the victim's current process, potentially compromising a training environment or developer workstation.

Delivery

Attacker crafts a malicious file or link referencing aeon's dataset loader and distributes it via a notebook, repo, or webpage.

AML.T0011.000

User Execution

Victim opens the malicious file or visits the malicious page, invoking load_human_activity_segmentation_datasets with attacker-controlled input.

AML.T0011

Code Injection

The unsanitized, user-supplied string is used by aeon to execute Python code, exploiting CWE-94.

AML.T0050

Impact

Attacker gains arbitrary code execution in the context of the victim's current process, potentially compromising a training environment or developer workstation.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
aeon	—	—	No patch

Do you use aeon? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade aeon to the patched version referencing commit 7519180 in the aeon-toolkit/aeon GitHub repository — confirm the fix is included in your installed release. 2) Until patched, avoid calling load_human_activity_segmentation_datasets with any string/path/URL sourced from an untrusted party (shared notebooks, forked repos, dataset links from email or chat). 3) Treat this like any other 'don't unpickle/eval untrusted data' control: sandbox or containerize notebook/training environments that ingest external datasets, and strip unnecessary outbound network/credential access from those environments. 4) Detection: monitor for anomalous child-process creation or unexpected shell/network activity originating from Python processes that import aeon, since exploitation manifests as arbitrary code execution rather than a distinct network signature.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainTraining DataFrameworkAML.T0010.002- Data AML.T0011- User Execution AML.T0011.000- Unsafe AI Artifacts AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3-AI system data acquisition and quality

NIST AI RMF

MEASURE 2.7-AI system security and resilience

Frequently Asked Questions

What is CVE-2026-18286?

A code injection vulnerability in aeon's load_human_activity_segmentation_datasets function allows arbitrary Python code execution when a data scientist opens a malicious file or visits a crafted page that triggers the vulnerable loader — the function passes a user-supplied string into code execution without validation (CWE-94). There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, and the package carries a risk score of 0/100 with unknown downstream dependent counts, so this reads as a low-volume research disclosure (ZDI-CAN-29160) rather than an actively exploited threat. The blast radius is nonetheless real for any ML team using aeon for human activity/time-series segmentation: a single researcher or engineer opening a shared notebook, dataset file, or link that invokes this loader hands an attacker code execution in their environment — potentially a training pipeline or CI runner with broader access. Patch by pulling the fix referenced in the vendor commit (aeon-toolkit/aeon@7519180) and upgrading aeon in all environments that load human activity segmentation datasets; until patched, treat any externally-sourced dataset file or notebook using this loader as untrusted and review/sandbox before execution. Detection should focus on unexpected child processes spawned from Python/Jupyter sessions running aeon rather than network signatures, since exploitation is local/user-driven, not remote-service-facing.

Is CVE-2026-18286 actively exploited?

No confirmed active exploitation of CVE-2026-18286 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18286?

1) Upgrade aeon to the patched version referencing commit 7519180 in the aeon-toolkit/aeon GitHub repository — confirm the fix is included in your installed release. 2) Until patched, avoid calling load_human_activity_segmentation_datasets with any string/path/URL sourced from an untrusted party (shared notebooks, forked repos, dataset links from email or chat). 3) Treat this like any other 'don't unpickle/eval untrusted data' control: sandbox or containerize notebook/training environments that ingest external datasets, and strip unnecessary outbound network/credential access from those environments. 4) Detection: monitor for anomalous child-process creation or unexpected shell/network activity originating from Python processes that import aeon, since exploitation manifests as arbitrary code execution rather than a distinct network signature.

What systems are affected by CVE-2026-18286?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, ml data loading utilities, research/notebook environments.

What is the CVSS score for CVE-2026-18286?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinesml data loading utilitiesresearch/notebook environments

MITRE ATLAS Techniques

AML.T0010.002Data

AML.T0011User Execution

AML.T0011.000Unsafe AI Artifacts

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_human_activity_segmentation_datasets method. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29160.

Exploitation Scenario

An attacker publishes a seemingly legitimate research notebook, blog tutorial, or dataset link referencing aeon's human activity segmentation utilities on GitHub, Kaggle, or a research forum. A data scientist or ML engineer, exploring the tutorial or opening a shared file, triggers load_human_activity_segmentation_datasets with the attacker-controlled string embedded in the file/link. Because the function fails to validate the input before using it to execute Python code, the attacker's payload runs in the context of the victim's current process — potentially a Jupyter kernel, CI training job, or developer workstation — giving the attacker a foothold to exfiltrate credentials, pivot to connected infrastructure, or tamper with the training pipeline.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.