CVE-2023-35932

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-35932
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35932.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-35932
Aliases
Published
2023-06-23T21:05:32.790Z
Modified
2025-12-04T23:56:07.104272Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
jcvi vulnerable to Configuration Injection due to unsanitized user input
Details

jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is for instance shell code execution from the configuration file values. This vulnerability does not currently have a fix.

Database specific 
{
    "cwe_ids": [
        "CWE-77"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35932.json"
}
References

Affected packages

Git /

Affected ranges