CVE-2024-23346
A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.82%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.82% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- materialsvirtuallab/pymatgen
- Source
- security-advisories@github.com
References
- https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108Broken Link
- https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5aPatch
- https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2fExploit, Vendor Advisory
- https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108Broken Link
- https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5aPatch
- https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2fExploit, Vendor Advisory
- https://www.vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.