Open-source package vulnerability · PyPI
CVE-2024-23731: Code execution in Embedchain
criticalCVSS 3.1 9.8GHSA-rhhj-5436-95vf
The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.
Published Jan 21, 2024 · Updated Jan 26, 2024
Affected packages
embedchain
- Ecosystem
- PyPI
- Affected
- < 0.1.57
- Fixed in
- 0.1.57
- Check
pip show embedchain
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology