Code Injection in pydash - CVE-2023-26145

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. A remote attacker can use these paths to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.

Affected software

How to mitigate CVE-2023-26145

External References

• https://github.com/dgilland/pydash/commit/6ff0831ad285fff937cafd2a853f20cc9ae92021
• https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca
• https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518

Related Security Bulletins

• Code injection in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics