pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string
Priority HIGH 76CWE-77Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03848 90th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed pymatgen (materialsproject): 2024.2.20pymatgen (PyPI): 2024.2.20
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| materialsproject | pymatgen | before 2024.2.20 | 2024.2.20 | Patch available | CNA |
| — | pymatgen (PyPI) | before 2024.2.20 | 2024.2.20 | Patch available | GHSA-vgv8-5cpj-qj2f |
- pymatgen Vendormaterialsproject Affected before 2024.2.20 Fixed in 2024.2.20 Patch available CNA
- pymatgen (PyPI) Vendor— Affected before 2024.2.20 Fixed in 2024.2.20 Patch available GHSA-vgv8-5cpj-qj2f
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:materialsvirtuallab:pymatgen:*:*:*:*:*:*:*:* | before 2024.2.20 | Vulnerable | Materialsvirtuallab |
- cpe:2.3:a:materialsvirtuallab:pymatgen:*:*:*:*:*:*:*:* Versions before 2024.2.20 Vulnerable ·Materialsvirtuallab
Remediation
- Fix · CNA pymatgen (materialsproject) Fixed in 2024.2.20
- Fix · GHSA-vgv8-5cpj-qj2f pymatgen (PyPI) Fixed in 2024.2.20 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-23346
- 2026-10-03 Alias added: GHSA-vgv8-5cpj-qj2f
- 2026-10-23 EPSS moved to the 90th–95th percentile
References
Exploit 2
More Materialsvirtuallab Pymatgen vulnerabilities
- TI-2022-20944 Exponential ReDoS in pymatgen leads to denial of service CVSS 3.1HIGH 7.5
Sources
- CVE-2024-23346 · CVE Program
- CVE-2024-23346 · NVD
- FIRST EPSS
- GHSA-vgv8-5cpj-qj2f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences