What is GHSA-w9h2-px87-74vx?

GHSA-w9h2-px87-74vx is a security advisory published by GitHub Security Advisories with High severity. vantage6 remote code execution vulnerability

Which CVE IDs does GHSA-w9h2-px87-74vx cover?

GHSA-w9h2-px87-74vx covers the following CVE IDs: CVE-2024-21649. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w9h2-px87-74vx?

GHSA-w9h2-px87-74vx has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-w9h2-px87-74vx?

GHSA-w9h2-px87-74vx affects 1 product, including: pip/vantage6:\u003c 4.2.0.

GHSA-w9h2-px87-74vxHighCVSS 8.8

vantage6 remote code execution vulnerability

Vendor

GitHub Security Advisories

Published

January 30, 2024

Last Modified

February 8, 2024

🔗 CVE IDs covered (1)

CVE-2024-21649 →

📋 Description

Impact

Authenticated users could inject code into algorithm environment variables

Workarounds

🎯 Affected products1

pip/vantage6:< 4.2.0

🔗 References (5)

https://github.com/vantage6/vantage6/security/advisories/GHSA-w9h2-px87-74vx
https://nvd.nist.gov/vuln/detail/CVE-2024-21649
https://github.com/vantage6/vantage6/commit/eac19db737145d3ca987adf037a454fae0790ddd
https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2024-30.yaml
https://github.com/advisories/GHSA-w9h2-px87-74vx