CVE-2024-23346

Katalog CVE

CVSS 7.8 · High EPSS 3,8%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada materialsvirtuallab pymatgen. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.

Rincian

Terbit di NVD

21 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

3,8% peluang dieksploitasi; lebih tinggi dari 89,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f exploit · advisory vendor
• https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a patch
• https://www.vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346 exploit · advisory pihak ketiga
• https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108 broken link