Read the docs
TI-2024-37288 Aliases CVE-2024-56327GHSA-47h8-jmp3-9f28

Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage

Priority MEDIUM 42CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00499 43rd percentileScored 2026-11-07
Fix Fixed pyrage (woodruffw): 1.2.3pyrage (PyPI): 1.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
woodruffwpyrage1.2.0 to before 1.2.31.2.3Patch availableCNA
—pyrage (PyPI)1.2.0 to before 1.2.31.2.3Patch availableGHSA-47h8-jmp3-9f28
  • pyrage Vendorwoodruffw Affected 1.2.0 to before 1.2.3 Fixed in 1.2.3 Patch available CNA
  • pyrage (PyPI) Vendor— Affected 1.2.0 to before 1.2.3 Fixed in 1.2.3 Patch available GHSA-47h8-jmp3-9f28

Remediation

  • Fix · CNA pyrage (woodruffw) Fixed in 1.2.3
  • Fix · GHSA-47h8-jmp3-9f28 pyrage (PyPI) Fixed in 1.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-56327
  2. 2026-10-03 Alias added: GHSA-47h8-jmp3-9f28

References

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences