GHSA-r6v3-hpxj-r8rv

Suggest an improvement
Source
https://github.com/advisories/GHSA-r6v3-hpxj-r8rv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-r6v3-hpxj-r8rv/GHSA-r6v3-hpxj-r8rv.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-r6v3-hpxj-r8rv
Aliases
Published
2019-06-07T20:56:27Z
Modified
2024-10-16T02:18:49.741588Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Code Injection in PyXDG
Details

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDGCONFIGDIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.

Database specific
{
    "nvd_published_at": "2019-06-06T19:29:00Z",
    "cwe_ids": [
        "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-07T10:24:55Z"
}
References

Affected packages

PyPI / pyxdg

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.26

Affected versions

0.*

0.19
0.20
0.21
0.22
0.23
0.24
0.25