EUVD-2024-33491

Malicious code in bioql PyPI...

Qualys discovered that if unsanitized input was used with the library Modules: ScanDeps

...

Module-Scandeps Command Injection

The vulnerability of the Module-Scandeps library is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

CVE-2024-10224

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by opening a "pesky pipe" such as passing "commands|" as a filename or by passing arbitrary strings to eval...