CVE-2024-23346

EUVD-2024-0203
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.3 CRITICAL
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_MCNA
9.4 CRITICAL
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
Affected Products (NVD)
VendorProductVersion
materialsvirtuallabpymatgen
𝑥
< 2024.2.20
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pymatgen
bookworm
2022.11.7+dfsg1-11+deb12u1
fixed
bookworm (security)
2022.11.7+dfsg1-11+deb12u1
fixed
sid
2025.10.7+dfsg1-1
fixed
trixie
2025.2.18+dfsg1-5
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pymatgen
bionic
dne
focal
dne
jammy
needed
mantic
ignored
noble
dne
oracular
not-affected
plucky
not-affected
questing
not-affected
trusty
dne
xenial
dne
Common Weakness Enumeration
References
https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108
https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a
https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f
https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108
https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a
https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f
https://www.vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346