GHSA-4fgp-7vvm-m4jf

Source

https://github.com/advisories/GHSA-4fgp-7vvm-m4jf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-4fgp-7vvm-m4jf/GHSA-4fgp-7vvm-m4jf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4fgp-7vvm-m4jf

Aliases

CVE-2024-27321

Published

2024-09-12T15:33:00Z

Modified

2024-09-20T19:22:42.736545Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Refuel Autolab Eval Injection vulnerability

Details

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.

Database specific

{
    "nvd_published_at": "2024-09-12T13:15:12Z",
    "cwe_ids": [
        "CWE-1236",
        "CWE-95"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-12T19:49:50Z"
}

References

Affected packages

PyPI / refuel-autolabel

Package

Name: refuel-autolabel; View open source insights on deps.dev
Purl: pkg:pypi/refuel-autolabel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.0.8

Last affected

0.0.16

Affected versions

0.*

0.0.8

0.0.9

0.0.10

0.0.11

0.0.12

0.0.13

0.0.14

0.0.15

0.0.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-4fgp-7vvm-m4jf/GHSA-4fgp-7vvm-m4jf.json"