OS Command Injection in jw.util

2021-06-0221:45:12

Google

osv.dev

0.043 Low

EPSS

Percentile

92.3%

JSON

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.

CPENameOperatorVersion
jw-utileq1.4.1
jw-utileq1.9
jw-utileq-class.-jw.util.version.Version-
jw-utileq1.3.6
jw-utileq2.0a3
jw-utileq1.5a2
jw-utileq1.5a0
jw-utileq1.3.7
jw-utileq1.5b0
jw-utileq1.5a3

Name	Operator	Version
jw-util	eq	1.4.1
jw-util	eq	1.9
jw-util	eq	-class.-jw.util.version.Version-
jw-util	eq	1.3.6
jw-util	eq	2.0a3
jw-util	eq	1.5a2
jw-util	eq	1.5a0
jw-util	eq	1.3.7
jw-util	eq	1.5b0
jw-util	eq	1.5a3