GHSA-g2m8-f3x2-qprw

Source

https://github.com/advisories/GHSA-g2m8-f3x2-qprw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-g2m8-f3x2-qprw/GHSA-g2m8-f3x2-qprw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g2m8-f3x2-qprw

Aliases

CVE-2024-27320

Published

2024-09-12T15:33:00Z

Modified

2024-09-23T19:39:44.147051Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Refuel Autolab Eval Injection vulnerability

Details

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.

Database specific

{
    "cwe_ids": [
        "CWE-1236",
        "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-12T19:49:53Z",
    "nvd_published_at": "2024-09-12T13:15:11Z",
    "severity": "HIGH"
}

References

Affected packages

PyPI / refuel-autolabel

Package

Name: refuel-autolabel; View open source insights on deps.dev
Purl: pkg:pypi/refuel-autolabel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.0.8

Last affected

0.0.16

Affected versions

0.*

0.0.8

0.0.9

0.0.10

0.0.11

0.0.12

0.0.13

0.0.14

0.0.15

0.0.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-g2m8-f3x2-qprw/GHSA-g2m8-f3x2-qprw.json"