Arbitrary Code Execution Vulnerability in Refuel Autolabel Library

CVE-2024-27320

Summary

The Refuel Autolabel library versions 0.0.8 and later have a vulnerability that allows arbitrary code execution due to improper handling of CSV files during classification tasks. When a user attempts to create a classification task using a specially crafted CSV file, any embedded Python code within that file may be executed through an eval function. This flaw poses a significant risk, particularly if the CSV file is crafted by an attacker who can exploit this mechanism to run unauthorized commands on the victim's system.

References