Remote Code Execution

2024-03-2010:09:07

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

astropy

vulnerability

remote code execution

input validation

transformations.py

subprocess.popen

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

Percentile

15.5%

JSON

Astropy is vulnerable to remote code execution. The vulnerability is due to improper input validation in the to_dot_graph function in the file transformations.py, allowing an attacker to execute commands or scripts as a value to the savelayout argument, which are then executed through the subprocess.Popen function.