Command injection in Gerapy

CRITIQUE 9.8CVE-2020-7698 · GHSA-g57j-q48p-9vm2 · PYSEC-2020-44 · Published 29/07/2020 · updated 17/06/2026

En bref

CVE-2020-7698 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant gerapy, gerapy (gerapy).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.7%, plus élevée que 77.4% des vulnérabilités.
Correctif : mettre à jour vers 0.9.3 ou plus récent.

Package	Affected versions	Patched versions
gerapy PyPI	`< 0.9.3`	`0.9.3`
gerapy gerapy	`≥ 0.0.0, < 0.9.3`	`0.9.3`

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.

NVD description

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 0.9.3

0.9.3

≥ 0.0.0, < 0.9.3

0.9.3

Description

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.

NVD description

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.

Autres vulnérabilités de gerapy

Tout voir →