GHSA-4fgp-7vvm-m4jfHighCVSS 7.8
Refuel Autolab Eval Injection vulnerability
🔗 CVE IDs covered (1)
📋 Description
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.
🎯 Affected products1
- pip/refuel-autolabel:>= 0.0.8, <= 0.0.16