GHSA-7xw9-549r-8jrc

Source

https://github.com/advisories/GHSA-7xw9-549r-8jrc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7xw9-549r-8jrc

Published

2026-07-13T18:38:13Z

Modified

2026-07-13T18:46:54Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N CVSS Calculator

Summary

DIRAC: SQL injection and lack of access control in PilotManager service

Details

Details

A number of the functions in PilotManager pass parameters directly through to the database layer, which then does not do any escaping on the parameters. For example setPilotStatus: https://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/Service/PilotManagerHandler.py#L343-L349

https://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/DB/PilotAgentsDB.py#L117

This won't accept multiple statements separated by a semicolon, but a carefully crafted set of parameters containing SQL escapes would likely be able to change or return other database entries.

Further to this, the PilotManager access control is only set to "authenticated"; this allows these functions to be called by any user. This allows any user to manage (e.g. delete, read output of) any pilot pilot job: https://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/ConfigTemplate.cfg#L111-L118

This is fixed by changing the SQL statements to use proper parameter substitution and providing a suitable set of access rules for the exported pilot management functions.

Patched versions:

https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/ https://pypi.org/project/DIRAC/9.1.10/

Database specific

{
    "cwe_ids":  [
        "CWE-284",
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-13T18:38:13Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

PyPI / dirac

Package

Name: dirac; View open source insights on deps.dev
Purl: pkg:pypi/dirac

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6

Fixed

8.0.79

Affected versions

7.*

7.2a29

7.2.0a32

7.2.0a33

7.2.0a34

7.2.0a35

7.2.0a36

7.2.0a38

7.2.0a39

7.2.0

7.2.1

7.2.2

7.2.3

7.2.4

7.2.5

7.2.6

7.2.7

7.2.8

7.2.9

7.2.10

7.2.12

7.2.13

7.2.14

7.2.15

7.2.16

7.2.19

7.2.20

7.2.21

7.2.22

7.2.23

7.2.24

7.2.25

7.2.26

7.2.27

7.2.28

7.2.30

7.2.31

7.2.32

7.2.33

7.2.34

7.2.35

7.2.36

7.2.37

7.2.38

7.2.39

7.2.40

7.2.41

7.2.42

7.2.43

7.2.44

7.2.45

7.2.46

7.2.47

7.2.48

7.2.49

7.2.50

7.2.51

7.2.52

7.3.0a2

7.3.0a3

7.3.0a4

7.3.0a5

7.3.0a6

7.3.0a7

7.3.0a8

7.3.0a9

7.3.0a10

7.3.0a11

7.3.0a13

7.3.0a14

7.3.0a15

7.3.0a16

7.3.0a17

7.3.0a18

7.3.0a19

7.3.0a20

7.3.0a21

7.3.0a22

7.3.0a23

7.3.0a24

7.3.1

7.3.2

7.3.3

7.3.4

7.3.5

7.3.6

7.3.7

7.3.8

7.3.9

7.3.10

7.3.11

7.3.12

7.3.13

7.3.14

7.3.15

7.3.16

7.3.17

7.3.18

7.3.19

7.3.20

7.3.21

7.3.22

7.3.23

7.3.24

7.3.26

7.3.27

7.3.28

7.3.29

7.3.30

7.3.31

7.3.32

7.3.33

7.3.34

7.3.35

7.3.36

7.3.37

7.3.38

7.4.0a1

8.*

8.0.0a1

8.0.0a5

8.0.0a6

8.0.0a7

8.0.0a8

8.0.0a9

8.0.0a10

8.0.0a11

8.0.0a12

8.0.0a13

8.0.0a14

8.0.0a15

8.0.0a16

8.0.0a17

8.0.0a18

8.0.0a19

8.0.0a20

8.0.0a21

8.0.0a22

8.0.0a23

8.0.0a24

8.0.0a25

8.0.0a26

8.0.0a27

8.0.0a28

8.0.0a29

8.0.0

8.0.1

8.0.2

8.0.3

8.0.4

8.0.5

8.0.6

8.0.7

8.0.8

8.0.9

8.0.10

8.0.11

8.0.12

8.0.13

8.0.14

8.0.15

8.0.16

8.0.17

8.0.18

8.0.19

8.0.20

8.0.21

8.0.22

8.0.23

8.0.24

8.0.25

8.0.26

8.0.27

8.0.28

8.0.29

8.0.30

8.0.31

8.0.32

8.0.33

8.0.34

8.0.35

8.0.36

8.0.37

8.0.38

8.0.39

8.0.40

8.0.41

8.0.42

8.0.43

8.0.44

8.0.45

8.0.46

8.0.47

8.0.48

8.0.49

8.0.50

8.0.51

8.0.52

8.0.53

8.0.54

8.0.55

8.0.56

8.0.58

8.0.59

8.0.60

8.0.61

8.0.62

8.0.63

8.0.64

8.0.65

8.0.66

8.0.67

8.0.68

8.0.69

8.0.70

8.0.71

8.0.72

8.0.73

8.0.74

8.0.75

8.0.76

8.0.77

8.0.78

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json"

PyPI / dirac

Package

Name: dirac; View open source insights on deps.dev
Purl: pkg:pypi/dirac

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.1.0a1

Fixed

9.0.22

Affected versions

8.*

8.1.0a1

8.1.0a2

8.1.0a3

8.1.0a4

8.1.0a5

8.1.0a6

8.1.0a7

8.1.0a8

8.1.0a9

8.1.0a10

8.1.0a11

8.1.0a12

8.1.0a13

8.1.0a14

8.1.0a15

8.1.0a16

8.1.0a17

8.1.0a18

8.1.0a19

8.1.0a20

8.1.0a21

8.1.0a22

8.1.0a23

9.*

9.0.0a1

9.0.0a2

9.0.0a3

9.0.0a4

9.0.0a5

9.0.0a6

9.0.0a10

9.0.0a11

9.0.0a12

9.0.0a13

9.0.0a16

9.0.0a17

9.0.0a18

9.0.0a19

9.0.0a20

9.0.0a21

9.0.0a22

9.0.0a23

9.0.0a24

9.0.0a25

9.0.0a26

9.0.0a27

9.0.0a28

9.0.0a29

9.0.0a30

9.0.0a31

9.0.0a35

9.0.0a36

9.0.0a37

9.0.0a38

9.0.0a39

9.0.0a40

9.0.0a41

9.0.0a42

9.0.0a43

9.0.0a44

9.0.0a45

9.0.0a46

9.0.0a47

9.0.0a48

9.0.0a49

9.0.0a50

9.0.0a51

9.0.0a52

9.0.0a53

9.0.0a54

9.0.0a55

9.0.0a56

9.0.0a57

9.0.0a58

9.0.0a59

9.0.0a60

9.0.0a61

9.0.0a62

9.0.0a63

9.0.0a64

9.0.0a66

9.0.0a67

9.0.0a68

9.0.0a69

9.0.0a70

9.0.0

9.0.1

9.0.2

9.0.4

9.0.5

9.0.6

9.0.7

9.0.8

9.0.9

9.0.10

9.0.11

9.0.12

9.0.13

9.0.14

9.0.15

9.0.16

9.0.17

9.0.18

9.0.19

9.0.20

9.0.21

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json"

PyPI / dirac

Package

Name: dirac; View open source insights on deps.dev
Purl: pkg:pypi/dirac

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.1.0

Fixed

9.1.10

Affected versions

9.*

9.1.0

9.1.1

9.1.2

9.1.3

9.1.4

9.1.5

9.1.6

9.1.7

9.1.8

9.1.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json"