PT-2022-13109 · Loguru · Loguru

Published 2022-01-21 · Updated 2025-05-17 · CVE-2022-0329

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions loguru versions prior to 0.6.0

Description The issue concerns a lack of sanitization on log serialization, which can lead to arbitrary code execution. The function in question is intended for internal use only but is not restricted. This issue has been disputed by the maintainer, but the library's behavior has been altered in a commit. The issue was initially considered a security vulnerability but has been revoked.

Recommendations For versions prior to 0.6.0, update to version 0.6.0 to resolve the issue. As a temporary workaround, consider restricting the use of the function in question, intended for internal use only, until the update is applied.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-0329

GHSA-CVP7-C586-CMF4

OPENSUSE-SU-2025:15097-1

Affected Products

Loguru

References · 15

• 🔥 https://huntr.dev/bounties/1-pypi-loguru · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0329 · Security Note
• https://osv.dev/vulnerability/GHSA-cvp7-c586-cmf4 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15097-1 · Vendor Advisory
• https://github.com/delgan/loguru/commit/4b0070a4f30cbf6d5e12e6274b242b62ea11c81b · Note
• https://github.com/delgan/loguru · Note
• https://github.com/Delgan/loguru/issues/563 · Note
• https://suse.com/security/cve/CVE-2022-0329 · Note
• https://t.me/secharvester/12008 · Telegram Post
• https://t.me/defcon_news/94664 · Telegram Post
• https://t.me/cibsecurity/36013 · Telegram Post
• https://tomforb.es/cve-2022-0329-and-the-problems-with-automated-vulnerability-management · Note
• https://t.me/cvenotify/26025 · Telegram Post
• https://t.me/rnetsec/16391 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/6ALU37KIAFIGWZHFN7WCXVJLT66B56ET · Note