Bagofwords
Monthly
A code injection vulnerability exists in bagofwords (versions up to 0.0.297) within the generate_df function of backend/app/ai/code_execution/code_execution.py, allowing remote attackers with low privileges to inject and execute arbitrary code. The vulnerability (CWE-74: Improper Neutralization of Special Elements in Output) has a CVSS score of 6.3 (Medium) with network-based attack vector and low attack complexity, meaning exploitation requires only basic authentication and no user interaction. A public proof-of-concept exploit is already available, making this a practical threat requiring prompt remediation.
A code injection vulnerability exists in bagofwords (versions up to 0.0.297) within the generate_df function of backend/app/ai/code_execution/code_execution.py, allowing remote attackers with low privileges to inject and execute arbitrary code. The vulnerability (CWE-74: Improper Neutralization of Special Elements in Output) has a CVSS score of 6.3 (Medium) with network-based attack vector and low attack complexity, meaning exploitation requires only basic authentication and no user interaction. A public proof-of-concept exploit is already available, making this a practical threat requiring prompt remediation.