CVE-2023-41334

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-41334
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41334.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-41334
Aliases
Downstream
Related
Published
2024-03-18T18:48:14.795Z
Modified
2026-07-24T17:30:01.555436930Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
astropy vulnerable to RCE in TranformGraph().to_dot_graph function
Details

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph().to_dot_graph function. A malicious user can provide a command or a script file as a value to the savelayout argument, which will be placed as the first value in a list of arguments passed to subprocess.Popen. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41334.json",
    "cwe_ids": [
        "CWE-77"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/astropy/astropy

Affected ranges

Type
GIT
Repo
https://github.com/astropy/astropy
Events
Introduced
202be317c0b4b1a7c8d1f6eb7ef29117b0512908
Fixed
22057d37b1313f5f5a9b5783df0a091d978dccb5
Database specific 
{
    "extracted_events": [
        {
            "introduced": "5.3.2"
        },
        {
            "last_affected": "5.3.2"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:astropy:astropy:5.3.2:*:*:*:*:python:*:*"
}

Affected versions

5.*
5.3.2
= 5.*
= 5.3.2
v5.*
v5.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41334.json"