Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2022-42964

Exponential ReDoS in pymatgen leads to denial of service

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Materialsvirtuallab
Products
Pymatgen
CVE-2024-23346

pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.

CVSS 3.1 · 9.4 Critical EPSS 3.8% KEV · Not listed
Vendors
Materialsvirtuallab
Products
Pymatgen