critical9.8
CVE-2023-37659
xalpha vulnerable to Remote Code Execution
Impact
xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE). User input is not properly checked to be numerical values prior to being evaluated.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | xalpha | >= 0.11.4, < 0.11.9 | 0.11.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xalpha Project | Xalpha | from 0.11.4 through 0.11.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/refraction-ray/xalpha/issues/175
- https://github.com/advisories/GHSA-jx3q-5rgf-vrrr
- https://nvd.nist.gov/vuln/detail/CVE-2023-37659
- https://github.com/refraction-ray/xalpha/commit/6dceaa159a1a319d750ade20a4595956876657b6
- https://github.com/pypa/advisory-database/tree/main/vulns/xalpha/PYSEC-2023-116.yaml