Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

astropy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.4PyPIAmendedPublished

    RCE in TranformGraph().to_dot_graph function

    CVE-2023-41334 · GHSA-h2x6-5jx5-46hf

    Affected
    • PyPI astropy < 5.3.3
    Fixed in
    5.3.3· Vendor fix available
    Issue
    RCE due to improper input validation in TranformGraph().todotgraph function Details Due to improper input validation a malicious user can provide a command or a script file as a value to savelayout argument, which will be placed as the first value in a list of arguments passed to subprocess.Popen. https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539 Although an error will be raised, the command or script will be executed successfully. PoC Impact code execution on the user's machine

    Recommended action: Upgrade to 5.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →