Critical Code Injection RCE in Aeon load_time_series_segmentation_benchmark (CVE‑2026‑18287) Threatens Data‑Science Toolkits
What It Is — A remote code execution flaw in the load_time_series_segmentation_benchmark method of the open‑source Aeon toolkit. The vulnerability stems from unsanitized user‑supplied strings that are fed to Python’s execution engine.
Exploitability — CVSS 7.8 (High). Exploitation requires user interaction (the victim must open a malicious page or file). A proof‑of‑concept is included in the advisory; the vendor has issued a patch.
Affected Products — Aeon toolkit (all versions prior to the 2026‑07‑29 commit 7519180).
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) demand documented review and validation of code changes; an unchecked code‑injection path violates these controls.
- Continuous control monitoring can surface insecure code paths before they reach production, providing audit‑ready logs of remediation.
- Demonstrating a timely patch‑management process (evidence of applying the vendor’s fix) satisfies the “risk mitigation” criteria auditors scrutinize.
Recommended Actions
- Map the vulnerability to SOC 2 CC6.1 and CC7.1 controls; capture the patch commit as evidence of remediation.
- Deploy the vendor’s 2026‑07‑29 update across all environments and verify the fix with a static‑code scan.
- Integrate automated dependency and code‑quality scanning into your CI/CD pipeline to flag future unsanitized
eval‑style calls. - Record the incident in your risk register and update third‑party risk assessments for any downstream services that consume Aeon.
Source: Zero Day Initiative Advisory