Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00ZmdwLTd2dm0tbTRqZs4AA_fd

Refuel Autolab Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.

Permalink: https://github.com/advisories/GHSA-4fgp-7vvm-m4jf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ZmdwLTd2dm0tbTRqZs4AA_fd
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 2 months ago
Updated: 2 months ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-4fgp-7vvm-m4jf, CVE-2024-27321
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-27321
• https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel
• https://github.com/refuel-ai/autolabel/blob/v0.0.16/src/autolabel/dataset/validation.py#L129-L146
• https://github.com/advisories/GHSA-4fgp-7vvm-m4jf

Repository: https://github.com/refuel-ai/autolabel
Blast Radius: 0.0

Affected Packages