GHSA-jx3q-5rgf-vrrr

Source

https://github.com/advisories/GHSA-jx3q-5rgf-vrrr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jx3q-5rgf-vrrr

Aliases

Published

2023-07-11T15:31:18Z

Modified

2024-11-19T19:22:53Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

xalpha vulnerable to Remote Code Execution

Details

xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE). User input is not properly checked to be numerical values prior to being evaluated.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-11T22:46:05Z",
    "nvd_published_at":  "2023-07-11T15:15:20Z",
    "severity":  "CRITICAL"
}

References

Affected packages

PyPI / xalpha

Package

Name: xalpha; View open source insights on deps.dev
Purl: pkg:pypi/xalpha

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.11.4

Fixed

0.11.9

Affected versions

0.*

0.11.4

0.11.5

0.11.6

0.11.7

0.11.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-jx3q-5rgf-vrrr/GHSA-jx3q-5rgf-vrrr.json"