What is GHSA-X563-6HQV-26MR?

GHSA-X563-6HQV-26MR is a critical-severity insecure deserialization vulnerability in ibis-framework (pip), affecting versions < 7.1.0. It is fixed in 7.1.0. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.

Which versions of ibis-framework are affected by GHSA-X563-6HQV-26MR?

ibis-framework (pip) versions < 7.1.0 is affected.

Is there a fix for GHSA-X563-6HQV-26MR?

Yes. GHSA-X563-6HQV-26MR is fixed in 7.1.0. Upgrade to this version or later.

Is GHSA-X563-6HQV-26MR exploitable, and should I be worried?

Whether GHSA-X563-6HQV-26MR is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-X563-6HQV-26MR is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix GHSA-X563-6HQV-26MR?

Upgrade ibis-framework to 7.1.0 or later.

GHSA-X563-6HQV-26MR in ibis-framework

Q: Which versions of ibis-framework are affected by GHSA-X563-6HQV-26MR?

ibis-framework (pip) versions < 7.1.0 is affected.

Q: Is there a fix for GHSA-X563-6HQV-26MR?

Yes. GHSA-X563-6HQV-26MR is fixed in 7.1.0. Upgrade to this version or later.

Q: Is GHSA-X563-6HQV-26MR exploitable, and should I be worried?

Whether GHSA-X563-6HQV-26MR is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-X563-6HQV-26MR is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-X563-6HQV-26MR?

Upgrade ibis-framework to 7.1.0 or later.

Summary

Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file

Workarounds

Install pyarrow_hotfix and run import pyarrow_hotfix ahead of any and all import ibis statements.

For example:

import ibis

becomes

import pyarrow_hotfix
import ibis

References

https://www.cve.org/CVERecord?id=CVE-2023-47248
https://nvd.nist.gov/vuln/detail/CVE-2023-47248

Impact

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.

Note that Ibis itself makes extremely limited use of pyarrow.parquet.read_table:

read_table is used in tests, where the input file is entirely controlled by the Ibis developers
read_table is used in the ibis/examples/__init__.py as a fallback for backends that don't support reading Parquet directly. Parquet data used in ibis.examples are also managed by the Ibis developers. This Parquet data is generated from CSV files and SQLite databases.
The Pandas and Dask backends both use PyArrow to read Parquet files and are therefore affected.

Ibis does not make use of APIs that directly read from either Arrow IPC files or Feather files.

Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.

Affected versions

ibis-framework (< 7.1.0)

Security releases

ibis-framework → 7.1.0 (pip)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Ibis imports the pyarrow_hotfix package wherever pyarrow is used, as of version 7.1.0.

Upgrading to Arrow 14.0.1 is also a possible solution, starting in Ibis 7.1.0.

Frequently Asked Questions

What is GHSA-X563-6HQV-26MR? GHSA-X563-6HQV-26MR is a critical-severity insecure deserialization vulnerability in ibis-framework (pip), affecting versions < 7.1.0. It is fixed in 7.1.0. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
Which versions of ibis-framework are affected by GHSA-X563-6HQV-26MR? ibis-framework (pip) versions < 7.1.0 is affected.
Is there a fix for GHSA-X563-6HQV-26MR? Yes. GHSA-X563-6HQV-26MR is fixed in 7.1.0. Upgrade to this version or later.
Is GHSA-X563-6HQV-26MR exploitable, and should I be worried? Whether GHSA-X563-6HQV-26MR is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-X563-6HQV-26MR is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-X563-6HQV-26MR? Upgrade ibis-framework to 7.1.0 or later.