{"cve":"CVE-2024-41961","nvd":{"published":"2024-08-01T15:15:14.310","modified":"2026-06-17T07:48:32.043","status":"Deferred","description":"Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which later flows into an `eval` sink which executes the code. Fixed in commit 8bce00be93b95a6512ff68fe86bf9554e486bc02.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","score":9.6},"cwes":["CWE-94"],"references":["https://github.com/sapcc/elektra/commit/49aea3b365082681558bf3bf7bf4a51766cfc44d","https://github.com/sapcc/elektra/commit/8bce00be93b95a6512ff68fe86bf9554e486bc02","https://github.com/sapcc/elektra/security/advisories/GHSA-6j2h-486h-487q"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:53:51.317825789+00:00"},"epss":{"cve":"CVE-2024-41961","score":0.00619,"percentile":0.49692,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}