{"cve":"CVE-2023-35932","nvd":{"published":"2023-06-23T22:15:08.987","modified":"2026-06-17T06:05:29.647","status":"Modified","description":"jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is for instance shell code execution from the configuration file values. This vulnerability does not currently have a fix.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-1284","CWE-77"],"references":["https://github.com/tanghaibao/jcvi/blob/cede6c65c8e7603cb266bc3395ac8f915ea9eac7/jcvi/apps/base.py#LL2227C1-L2228C41","https://github.com/tanghaibao/jcvi/security/advisories/GHSA-x49m-3cw7-gq5q","https://github.com/tanghaibao/jcvi/blob/cede6c65c8e7603cb266bc3395ac8f915ea9eac7/jcvi/apps/base.py#LL2227C1-L2228C41","https://github.com/tanghaibao/jcvi/security/advisories/GHSA-x49m-3cw7-gq5q"],"products":["jcvi_project:jcvi"],"source":"nvd","synced_at":"2026-10-19T21:38:30.124994567+00:00"},"epss":{"cve":"CVE-2023-35932","score":0.01788,"percentile":0.78345,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-x49m-3cw7-gq5q","url":"https://osv.dev/vulnerability/GHSA-x49m-3cw7-gq5q","summary":"jcvi vulnerable to Configuration Injection due to unsanitized user input ","modified":"2026-09-10T03:49:57.127455238Z","packages":[{"ecosystem":"PyPI","name":"jcvi","purl":"pkg:pypi/jcvi","ranges":["<=1.3.5"],"fixed":[]}]},{"id":"PYSEC-2026-1470","url":"https://osv.dev/vulnerability/PYSEC-2026-1470","summary":"jcvi vulnerable to Configuration Injection due to unsanitized user input ","modified":"2026-07-07T17:47:15.625912516Z","packages":[{"ecosystem":"PyPI","name":"jcvi","purl":"pkg:pypi/jcvi","ranges":["<=1.3.5"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}