PT-2024-19825 · Pypi · Pymatgen

Steakenthusiast · Published 2024-02-21 · Updated 2025-03-08 · CVE-2024-23346

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pymatgen versions prior to 2024.2.20

Description A critical security issue exists in the JonesFaithfulTransformation.from transformation str() method within the pymatgen library. This method insecurely utilizes eval() for processing input, enabling execution of arbitrary code when parsing untrusted input. The vulnerability can be exploited when parsing a maliciously-created CIF file.

Recommendations For pymatgen versions prior to 2024.2.20, update to version 2024.2.20 to resolve the issue. As a temporary workaround, consider avoiding the use of the JonesFaithfulTransformation.from transformation str() method until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-23346

DSA-5763-1

GHSA-VGV8-5CPJ-QJ2F

PYSEC-2024-226

Affected Products

Pymatgen

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23346.json · Exploit
• 🔥 https://github.com/9carlo6/CVE-2024-23346 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346 · Exploit
• 🔥 https://exploit-db.com/exploits/52205 · Exploit
• https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f · Vendor Advisory
• https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a · Patch
• https://ubuntu.com/security/CVE-2024-23346 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23346 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-226 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vgv8-5cpj-qj2f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23346 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-23346 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-23346 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23346 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5763-1 · Vendor Advisory