pypi package report

Is pyarrow safe?

3 known vulnerabilities, worst severity CRITICAL.

// reach

1 direct dependencies

1 carry known advisories, worst CRITICAL

535 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai models

3 published models carry an advisory from this package

0 pin a version the advisory is confirmed against; the rest declare it without a version.

Accio-Lab/occamy-1.0-GGUFCRITICALnot pinned
tencent/EVIE-4.5BCRITICALnot pinned

3 published models

2 declared · 3 observed · 0 inferred

ModelEvidence
Accio-Lab/occamy-1.0-GGUFobserved
tencent/EVIE-4.5Bobserved
Create a free accountto see all 1 models and per-model risk

3 published AI models are associated with this package: 2 name it in a requirements or pyproject file, 3 load it or import it directly, and 0 are inferred from the runtime stack their declared library pulls in. Only 2 state a version requirement, so this is not a count of affected models.

cvss
9.8
critical

CVSS v3.1 base score out of 10

epss
14.5%
high

chance of exploitation in 30 days, 97th percentile of all CVEs

xyz score
6.0
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-5wvp-7f3h-6wmm, the advisory selected below

// 3 advisories

GHSA-5wvp-7f3h-6wmm

CRITICALGitHub ratingCVE-2023-47248

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).

This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.

It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.

If it is not possible to upgrade, maintainers provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Checked 2026-11-06 at 20:41 UTC. The most recent advisory here was published 2026-02-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.