CVE-2024-37064: 
Python vulnerability analysis and mitigation

Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded (HiddenLayer Advisory).

The vulnerability exists in the read_pandas utility function within src/ydata_profiling/utils/dataframe.py. The function supports loading pandas datasets from pickle files (.pkl, .pickle extensions) using pd.read_pickle, which can lead to arbitrary code execution when loading malicious pickle files. The vulnerability has been assigned a CVSS v3.1 score of 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and is categorized as CWE-502: Deserialization of Untrusted Data (HiddenLayer Advisory).

When exploited, this vulnerability allows attackers to execute arbitrary code on an end user's system through a maliciously crafted dataset. This occurs when the user loads the malicious dataset using the read_pandas function, which is also used by default in the command line tool (HiddenLayer Advisory).

The vulnerability can be exploited when a user loads a maliciously crafted pickle file through the read_pandas function. The attack requires user interaction to load the malicious dataset, but no privileges are needed for execution (HiddenLayer Advisory).