Aeon’s load_time_series_segmentation_benchmark method accepts a user‑supplied string and directly feeds it into Python’s execution engine without validation. This omission allows an attacker to craft malicious input that the process will run as code, granting the attacker full control over the application’s runtime environment. The flaw can be triggered only when a user visits a malicious page or opens a crafted file containing the injected string. Once the target renders that content through the benchmark function, arbitrary code runs with the privileges of the Aeon process, enabling data theft, persistence, or further network lateral movement. Because the vulnerability resides in a widely used data‑analysis routine, an attacker could target any AEON installation that exposes the benchmark functionality, potentially affecting multiple systems in an organization.

The affected product is Aeon Toolkit, specifically the load_time_series_segmentation_benchmark routine. Exact version information is not listed in the advisory, so any installation that includes this routine could be vulnerable. No specific product version identifiers or platform details are provided.

The CVSS score of 7.8 indicates a high impact vulnerability. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires user interaction— a malicious link or file must be accessed— but no authentication is needed, so the threat is remote. The attack vector likely involves phishing or compromised content served to a user who runs the benchmark function, leading to code execution in the application’s context.