Rae
Monthly
Code injection in RAE, through its Config-Driven Model Instantiation component, allows a local attacker with low-level privileges to cause arbitrary Python object resolution and potentially code execution when a user loads or runs a crafted model configuration. Exploitation is constrained to local access with required user interaction and only low confidentiality, integrity, and availability impact, so despite the RCE and code-injection tags this is assessed as a low-priority, low-real-risk issue. No public exploit code has been identified at time of analysis, and no vendor-released patch has been identified.
Code injection in RAE, through its Config-Driven Model Instantiation component, allows a local attacker with low-level privileges to cause arbitrary Python object resolution and potentially code execution when a user loads or runs a crafted model configuration. Exploitation is constrained to local access with required user interaction and only low confidentiality, integrity, and availability impact, so despite the RCE and code-injection tags this is assessed as a low-priority, low-real-risk issue. No public exploit code has been identified at time of analysis, and no vendor-released patch has been identified.