RCE in Astropy

CVE-2023-41334

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.011 (65.3th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 65th percentile — 65.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2023-41334: held from 0.011 to 0.011.

EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000

Affected products

  • Astropy — versions = 5.3.2, 5.3.2

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2023-41334?
CVE-2023-41334 is a high-severity vulnerability in Astropy, classified under Command Injection. CVSS score: 8.4/10. Published 2024-03-18.
How severe is CVE-2023-41334?
High severity. CVSS v3 base score is 8.4 out of 10.
Is CVE-2023-41334 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.