CVE-2024-23346

🗓️ 21 Feb 2024 16:13:25Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 334 Views🌐 WEB

Pymatgen (Python Materials Genomics) open-source library for materials analysis. Critical security vulnerability pre V2024.2.2

Reporter	Title	Published	Views	Family All 33
GithubExploit	Exploit for Command Injection in Materialsvirtuallab Pymatgen	24 Jul 202518:12	–	githubexploit
GithubExploit	Exploit for Command Injection in Materialsvirtuallab Pymatgen	9 Dec 202422:34	–	githubexploit
GithubExploit	Exploit for Command Injection in Materialsvirtuallab Pymatgen	25 Feb 202514:52	–	githubexploit
GithubExploit	Exploit for Command Injection in Materialsvirtuallab Pymatgen	20 Feb 202512:23	–	githubexploit
Circl	CVE-2024-23346	21 Feb 202415:45	–	circl
CNNVD	Pymatgen Security Vulnerability	21 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-23346 pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string	21 Feb 202416:13	–	cvelist
Debian	[SECURITY] [DSA 5763-1] pymatgen security update	30 Aug 202418:05	–	debian
Debian CVE	CVE-2024-23346	21 Feb 202416:13	–	debiancve
Tenable Nessus	Debian dsa-5763 : python-pymatgen-doc - security update	30 Aug 202400:00	–	nessus

NVD

Vulners

Vulnrichment

Node

materialsvirtuallab pymatgenRange<2024.2.20

[
  {
    "vendor": "materialsproject",
    "product": "pymatgen",
    "versions": [
      {
        "version": "< 2024.2.20",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py
github	www.github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a
github	www.github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f
vicarius	www.vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346

Parameter	Position	Path	Description	CWE
_space_group_magn.transform_BNS_Pp_abc	path	_space_group_magn.transform_BNS_Pp_abc	CIF parser vulnerability in Pymatgen 2024.1 allows remote code execution via crafted CIF file containing Python code in the _space_group_magn.transform_BNS_Pp_abc field.	CWE-77

17 Jun 2026 07:12Current

9.4Critical risk

Vulners AI Score9.4

CVSS 3.17.8 - 9.3

EPSS0.03816

SSVC

CWE-77