CRITICAL9.8
PYSEC-2023-262
Quick fix
PYSEC-2023-262 — searchor: upgrade to the fixed version with the command below.
pip install --upgrade 'searchor>=16016506f7bf92b0f21f51841d599126d6fcd15b'Details
main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/searchor
Introduced in:
0Fixed in: 16016506f7bf92b0f21f51841d599126d6fcd15bFix
pip install --upgrade 'searchor>=16016506f7bf92b0f21f51841d599126d6fcd15b'References
- https://github.com/ArjunSharda/Searchor/pull/130[FIX]
- https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-[EVIDENCE]
- https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection[EVIDENCE]
- https://github.com/advisories/GHSA-66m2-493m-crh2[ADVISORY]
- https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b[FIX]