Read the docs
TI-2024-28346 Aliases CVE-2024-42360GHSA-qv32-5wm2-p32h

Command Injection in sequenceserver

Priority MEDIUM 50CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00584 48th percentileScored 2026-11-07
Fix Fixed sequenceserver (wurmlab): 3.1.2sequenceserver (RubyGems): 3.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wurmlabsequenceserverbefore 3.1.23.1.2Patch availableCNA
—sequenceserver (RubyGems)before 3.1.23.1.2Patch availableGHSA-qv32-5wm2-p32h
  • sequenceserver Vendorwurmlab Affected before 3.1.2 Fixed in 3.1.2 Patch available CNA
  • sequenceserver (RubyGems) Vendor— Affected before 3.1.2 Fixed in 3.1.2 Patch available GHSA-qv32-5wm2-p32h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wurmlab:sequenceserver:*:*:*:*:*:ruby:*:*before 3.1.2Vulnerablewurmlab
  • cpe:2.3:a:wurmlab:sequenceserver:*:*:*:*:*:ruby:*:* Versions before 3.1.2 Vulnerable ·wurmlab

Remediation

  • Fix · CNA sequenceserver (wurmlab) Fixed in 3.1.2
  • Fix · GHSA-qv32-5wm2-p32h sequenceserver (RubyGems) Fixed in 3.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42360
  2. 2026-10-03 Alias added: GHSA-qv32-5wm2-p32h
  3. 2026-10-29 CISA SSVC decision points changed

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences