Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nMm04LWYzeDItcXByd84AA_ff

Refuel Autolab Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.

Permalink: https://github.com/advisories/GHSA-g2m8-f3x2-qprw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMm04LWYzeDItcXByd84AA_ff
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 2 months ago
Updated: 2 months ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-g2m8-f3x2-qprw, CVE-2024-27320
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-27320
• https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel
• https://github.com/refuel-ai/autolabel/blob/v0.0.16/src/autolabel/dataset/validation.py#L57-L79
• https://github.com/advisories/GHSA-g2m8-f3x2-qprw

Repository: https://github.com/refuel-ai/autolabel
Blast Radius: 0.0

Affected Packages