GHSA-vxf2-7rc3-pxmx

Suggest an improvement
Source
https://github.com/advisories/GHSA-vxf2-7rc3-pxmx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vxf2-7rc3-pxmx/GHSA-vxf2-7rc3-pxmx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vxf2-7rc3-pxmx
Aliases
Published
2022-05-01T02:00:38Z
Modified
2023-11-08T03:56:45.678312Z
Summary
Cheetah Path Search Order Hijacking
Details

Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.

Database specific
{
    "nvd_published_at": "2005-05-17T04:00:00Z",
    "cwe_ids": [
        "CWE-427"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-18T23:34:20Z"
}
References

Affected packages

PyPI / cheetah

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.9.15
Last affected
0.9.16