Most recent entries from all

EUVD-2026-204930

fkie_cve-2023-35932

jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is for instance shell code execution from the configuration file values. This vulnerability does not currently have a fix.

GHSA-x49m-3cw7-gq5q — jcvi vulnerable to Configuration Injection due to unsanitized user input

Affected: PyPI: jcvi

### Summary A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection.

### PoC

The vulnerable code snippet is [/jcvi/apps/base.py#LL2227C1-L2228C41](https://github.com/tanghaibao/jcvi/blob/cede6c65c8e7603cb266bc3395ac8f915ea9eac7/jcvi/apps/base.py#LL2227C1-L2228C41). Under some circumstances a user input is retrieved and stored within the `fullpath` variable which reaches the configuration file `~/.jcvirc`.

```python fullpath = input(msg).strip() config.set(PATH, name, fullpath) ```

I ripped a part of the codebase into a runnable PoC as follows. All the PoC does is call the `getpath()` function under some circumstances.

```python from configparser import ( ConfigParser, RawConfigParser, NoOptionError, NoSectionError, ParsingError, )

import errno import os import sys import os.path as op import shutil import signal import sys import logging

def is_exe(fpath): return op.isfile(fpath) and os.access(fpath, os.X_OK)

def which(program): """ Emulates the unix which command.

>>> which("cat") "/bin/cat" >>> which("nosuchprogram") """ fpath, fname = op.split(program) if fpath: if is_exe(program): return program else: for path in os.environ["PATH"].split(os.pathsep): exe_file = op.join(path, pr…

gsd-2023-35932

PYSEC-2026-1470 — jcvi vulnerable to Configuration Injection due to unsanitized user input