PyPI: embedchain
CVE-2024-23731
Safety vulnerability ID: SFTY-20240121-49422
Safety legacy ID: pyup.io-66691
The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.
Overview
Code execution in Embedchain
Advisory
The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.
How to Fix
Upgradeembedchainto0.1.57or higher.
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240121-49422/CVE-2024-23731
- https://nvd.nist.gov/vuln/detail/CVE-2024-23731
- https://github.com/embedchain/embedchain/pull/1122
- https://github.com/embedchain/embedchain/compare/0.1.56...0.1.57
- https://github.com/pypa/advisory-database/tree/main/vulns/embedchain/PYSEC-2024-7.yaml
- https://github.com/advisories/GHSA-rhhj-5436-95vf
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more