Lucene search

K
osvGoogleOSV:GHSA-VXF2-7RC3-PXMX
HistoryMay 01, 2022 - 2:00 a.m.

Cheetah Path Search Order Hijacking

2022-05-0102:00:38
Google
osv.dev
5
cheetah 0.9.15
0.9.16
path search
hijacking
arbitrary code
/tmp directory

EPSS

0

Percentile

5.1%

Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.

EPSS

0

Percentile

5.1%

Related for OSV:GHSA-VXF2-7RC3-PXMX