Skip to content
OpenAdvisories
High · 8.4 CVE-2023-41334 EUVD-2024-0929GHSA-h2x6-5jx5-46hfPYSEC-2026-1199

astropy vulnerable to RCE in TranformGraph().to_dot_graph function

Published Mar 18, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.

Affected products

VendorProductAffectedFixed
astropy astropy = 5.3.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 astropy 5.3.3-1 —
Debian 13 astropy 5.3.3-1 —
Debian 12 astropy No fix yet —
Debian 10 astropy 3.1.2-2+deb10u1 DLA-3803-1
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS astropy No fix yet —
Ubuntu 20.04 LTS astropy No fix yet —
Ubuntu 18.04 LTS astropy No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-astropy 8.0.1-1.1 openSUSE-SU-2026:11353-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI astropy < 5.3.3 5.3.3 GHSA-h2x6-5jx5-46hf

Advisories 2

References