CVE-2024-53924

Description

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("__import__('os').system( substring.

How to fix CVE-2024-53924

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• PyPI/pycel—no fix listed
• —no fix listed

Is CVE-2024-53924 being exploited?

Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, <= 1.0b30
• from 0, <= 1.0-beta0, <= 1.0-beta11, <= 1.0-beta12, <= 1.0-beta13, <= 1.0-beta14, <= 1.0-beta15, <= 1.0-beta16, <= 1.0-beta17, <= 1.0-beta18, <= 1.0-beta19, <= 1.0-beta2, <= 1.0-beta20, <= 1.0-beta21, <= 1.0-beta22, <= 1.0-beta26, <= 1.0-beta27, <= 1.0-beta28, <= 1.0-beta29, <= 1.0-beta3, <= 1.0-beta30, <= 1.0-beta4, <= 1.0-beta5, <= 1.0-beta6, <= 1.0-beta7, <= 1.0-beta8

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-pw67-xjhq-389w
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-53924
• PATCHgithub.com/stephenrauch/pycel
• PATCHpypi.org/project/pycel/
• WEBgist.github.com