CVE-2024-27321

CVE-2024-27321 affects Refuel Autolabel (versions 0.0.8 and newer). A multilabel classification task can process a malicious CSV that contains Python code, which is passed to eval and executed. The vulnerability enables arbitrary code execution with high impact (confidentiality, integrity, availa...

CVE-2024-27320

The CVE-2024-27320 entry concerns the Refuel Autolabel library. The connected PT-2024-21820 and related sources confirm an arbitrary code execution flaw in versions 0.0.8 and newer, caused by handling of CSV files in classification tasks where Python code can be injected and executed via eval. Im...