GitHub Advisoryadvisory · PyPI

GHSA-g2m8-f3x2-qprw Refuel Autolab Eval Injection vulnerability

HIGH Published 2024-09-12 Modified 2024-09-23 Official page ↗
Aliases
CVE-2024-27320
Ecosystem
PyPI
Packages
refuel-autolabel
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-1236, CWE-95
Reviewed
2024-09-12

Affected packages

• PyPI refuel-autolabel: >= 0.0.8, <= 0.0.16 (no fix yet)

Description

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.

Related

Alias · CVE (1)

  • CVE-2024-27320 An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its… vulnerability

Weakness · CWE (2)

  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References