Vulnerability · Published Nov 21, 2023 · Assigned by GitHub_M
CVE-2023-48699fastbots Eval Injection vulnerability
High 8.4
In plain English
A high-severity security flaw in fastbots from ubertidavide. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function `def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.1.5 or above.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | fastbots | 0.1.5 | GHSA-vccg-f4gp-45x9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ubertidavide | fastbots | < 0.1.5 |
Weakness: CWE-95 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H