Lookup for vulnerable packages by Package URL.
| Purl | pkg:pypi/pydash@4.3.1 |
|---|
| Type | pypi |
|---|
| Namespace | |
|---|
| Name | pydash |
|---|
| Version | 4.3.1 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 6.0.0 |
|---|
| Latest_non_vulnerable_version | 6.0.0 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-uzfr-vhbe-3qgb |
| vulnerability_id |
VCID-uzfr-vhbe-3qgb |
| summary |
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.
**Note:**
The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:
1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)
2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)
The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-26145, GHSA-8mjr-6c96-39w8, PYSEC-2023-179
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-uzfr-vhbe-3qgb |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:pypi/pydash@4.3.1 |
|---|