CVE-2024-23346

Deeper analysis

Pymatgen, an open-source Python library for materials analysis, contains a critical vulnerability in the JonesFaithfulTransformation.from_transformation_str method prior to version 2024.2.20. The method passes untrusted input directly to eval, enabling arbitrary code execution during parsing of transformation strings and resulting in a CVSS 9.3 score under CWE-77.

An attacker able to supply a malicious transformation string to the affected method can achieve full code execution in the context of the calling application. Because the call requires no authentication or user interaction and crosses a security boundary, the flaw permits an adversary to compromise confidentiality, integrity, and availability on the host system.

The project advisory and patch commit c231cbd3d5147ee920a37b6ee9dd236b376bcf5a indicate that updating to pymatgen 2024.2.20 resolves the issue by removing the unsafe eval usage. The current and peak EPSS scores both stand at 0.5929 with no material rise after disclosure.