R LANGUAGE FLAW ALLOWS CODE EXECUTION VIA RDS/RDX FILES

Summary from the TLDR InfoSec newsletter

A critical vulnerability has been discovered in the R programming language, widely used for data analysis and AI/ML, that allows arbitrary code execution when deserializing specially crafted RDS and RDX files. The vulnerability exploits R's handling of serialization/deserialization, enabling attackers to embed malicious code in file metadata for execution upon opening the files.