CVE-2024-23346

Summary

CVE-2024-23346 is a critical security vulnerability affecting the Pymatgen (Python Materials Genomics) library before version 2024.2.20. The issue resides in the `JonesFaithfulTransformation.from_transformation_str()` method, which unsafely employs `eval()` for processing unverified user input. This misuse of `eval()` allows the execution of arbitrary code, exposing systems to potential attacks. Version 2024.2.20 rectifies the vulnerability by implementing more secure parsing techniques.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.