pyarrow-hotfix
Decision gist · record as of 2026-08-14
Yes, if you are running PyArrow older than 14.0.1 and cannot upgrade immediately. The package is lightweight, has no dependencies, and directly addresses a known remote code execution vulnerability. If you are already on PyArrow 14.0.1 or later, it is unnecessary. Maintenance is aging but the fix itself is stable and unlikely to require frequent updates.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- PyArrow must be installed separately; this package assumes it is already present in your environment.
- Low friction—pure Python wheel with no runtime dependencies.
- Maintenance is aging; last release was 476 days ago, though the repository remains active and the package supports modern Python versions.
License · maintenance · safety
Apache License, Version 2.0 (permissive) — Apache License 2.0 (permissive) allows commercial and private use with minimal restrictions, matching PyArrow's own licensing.
last release 2025-04-25 (476 days) · last repo commit 2025-04-25 · 2 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 41,352,095 downloads/mo, #673 on PyPI
Alternatives
Verify before relying
pip install pyarrow-hotfix
import pyarrow as pa
import pyarrow_hotfix
# Now pa.ipc.open_file() will reject malicious serialized data- Whether CVE-2023-47248 remains exploitable in PyArrow versions between 0.14.0 and 14.0.0 without this hotfix.
- Whether importing pyarrow_hotfix has any performance or behavioral side effects on normal PyArrow operations.
- Current status of the vulnerability in PyArrow releases after 14.0.1.
What it is and what it does
pyarrow_hotfix is a minimal security patch for PyArrow that mitigates CVE-2023-47248, a deserialization vulnerability that allows arbitrary code execution through malicious Arrow IPC files. The vulnerability affects PyArrow versions prior to 14.0.1; this package provides a workaround for users who cannot upgrade immediately by disabling the unsafe behavior when imported.
The package is pure Python with no external dependencies beyond PyArrow itself, and supports Python 3.5 and later. It works by patching PyArrow's deserialization logic at import time to reject dangerous pickle opcodes in serialized extension types. Simply importing it in your application activates the protection—no configuration or API calls are required.
Use it for
- Protect legacy applications running on older PyArrow versions when upgrading is not immediately feasible.
- Add a security layer to data pipelines that consume untrusted Arrow IPC files from external sources.
- Mitigate CVE-2023-47248 in containerized or managed environments where PyArrow version is pinned.
- Temporary defense while planning a full PyArrow upgrade to 14.0.1 or later.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you are running PyArrow older than 14.0.1 and cannot upgrade immediately.
The package is lightweight, has no dependencies, and directly addresses a known remote code execution vulnerability. If you are already on PyArrow 14.0.1 or later, it is unnecessary. Maintenance is aging but the fix itself is stable and unlikely to require frequent updates.
Install
pyarrow-hotfix on PyPI
Before you install
Low friction—pure Python wheel with no runtime dependencies. Maintenance is aging; last release was 476 days ago, though the repository remains active and the package supports modern Python versions.
PyArrow must be installed separately; this package assumes it is already present in your environment.
License in practice
Apache License 2.0 (permissive) allows commercial and private use with minimal restrictions, matching PyArrow's own licensing.
Quickstart
pip install pyarrow-hotfix
import pyarrow as pa
import pyarrow_hotfix
# Now pa.ipc.open_file() will reject malicious serialized dataVerify before relying
- Whether CVE-2023-47248 remains exploitable in PyArrow versions between 0.14.0 and 14.0.0 without this hotfix.
- Whether importing pyarrow_hotfix has any performance or behavioral side effects on normal PyArrow operations.
- Current status of the vulnerability in PyArrow releases after 14.0.1.
Package facts
| License | Apache License, Version 2.0 permissive |
| Python support | Supports the current Python release >=3.5 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Aging 476 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 41,352,095 / month, #673 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.5Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9 |
Evidence: pyarrow_hotfix-0.7-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “pyarrow cve-2023-47248 hotfix”
- pyarrow-hotfixDisables the CVE-2023-47248 security vulnerability in older PyArrow…
- semver4Parses and manipulates semantic versions with an optional fourth…
- pyarrowfs-adlgen2Provides a PyArrow filesystem interface for reading and writing…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also fickling · pydantic-to-pyarrow · pyarrow · geoarrow-pyarrow · semver4 · pyarrowfs-adlgen2 · picklescan · geoarrow-pandas · zodbpickle · pypickle