CVE-2024-29189

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-29189
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29189.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-29189
Aliases
Published
2024-03-26T02:50:34.984Z
Modified
2025-12-17T05:48:51.665203Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ansys-geometry-core OS Command Injection vulnerability
Details

PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/productinstance.py, upon calling this method _startprogram directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29189.json"
}
References

Affected packages

Git / github.com/ansys/pyansys-geometry

Affected ranges

Type
GIT
Repo
https://github.com/ansys/pyansys-geometry
Events
Introduced
3df28eac4dc03ba3ba6da5d1c33b9fe5d80cd3ee
Fixed
e3614a812bda246e46f47564241056429430d494
Database specific 
{
    "versions": [
        {
            "introduced": "0.3.0"
        },
        {
            "fixed": "0.3.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/ansys/pyansys-geometry
Events
Introduced
1d73f96ad58946588a260969dcd360de12db7453
Fixed
a9c29d9d87656ec75778db94749f6359d2165d21
Database specific 
{
    "versions": [
        {
            "introduced": "0.4.0"
        },
        {
            "fixed": "0.4.12"
        }
    ]
}

Affected versions

v0.*

v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.4.1
v0.4.10
v0.4.11
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29189.json"