CVE-2024-27320
12.09.2024, 13:15
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.
| Vendor | Product | Version |
|---|---|---|
| refuel | autolabel | * ≤ 𝑥 ≤ * |
| refuel | autolabel | 0.0.8 ≤ |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV FileThe software saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software.