CVE-2024-53924

Summary

Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=200, eval("import('os').system( substring.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://gist.github.com/aelmosalamy/cb098e61939718d2bb248fd1cc94f287

References

• https://pypi.org/project/pycel/
• https://github.com/stephenrauch/pycel
• https://github.com/dgorissen/pycel
• https://gist.github.com/aelmosalamy/cb098e61939718d2bb248fd1cc94f287

• ←Previous
• Next→