GitHub Advisoryadvisory · PyPI

GHSA-4fgp-7vvm-m4jf Refuel Autolab Eval Injection vulnerability

HIGH Published 2024-09-12 Modified 2024-09-20 Official page ↗
Aliases
CVE-2024-27321
Ecosystem
PyPI
Packages
refuel-autolabel
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-1236, CWE-95
Reviewed
2024-09-12

Affected packages

• PyPI refuel-autolabel: >= 0.0.8, <= 0.0.16 (no fix yet)

Description

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.

Related

Alias · CVE (1)

  • CVE-2024-27321 An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its… vulnerability

Weakness · CWE (2)

  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References