The vulnerability lies in the deserialization of untrusted data within the load_rehab_pile_dataset method of Aeon. This flaw permits a remote attacker, by providing malicious input, to execute arbitrary code in the context of the target process. The lack of proper validation allows the unsafe processing of user-supplied data, leading to potential breach of confidentiality, integrity, and availability.

Aeon functions built on the aeon:aeon platform are affected by this issue. The description does not specify exact version numbers, so any installation that includes the load_rehab_pile_dataset method may be vulnerable.

The CVSS score of 7.8 indicates a high severity. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file, so the attack vector is likely client‑side rather than network‑side. The EPSS score is not available, and the vulnerability is not listed in KEV, so current exploitation likelihood is uncertain. However, any environment where the affected method processes external input presents a critical real‑world risk for remote code execution.