{"id":"CVE-2024-27320","aliases":["GHSA-g2m8-f3x2-qprw","PYSEC-2026-1870"],"title":"Refuel Autolab Eval Injection vulnerability","summary":"Refuel Autolab Eval Injection vulnerability","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"refuel-autolabel","product":"refuel-autolabel","ecosystem":"pip","affected":["refuel-autolabel >= 0.0.8, <= 0.0.16"],"published":"2024-09-12","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-g2m8-f3x2-qprw","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27320"},{"url":"https://github.com/refuel-ai/autolabel"},{"url":"https://github.com/refuel-ai/autolabel/blob/v0.0.16/src/autolabel/dataset/validation.py#L57-L79"},{"url":"https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel"}],"tags":["osv","pip"],"epss":0.00352,"epssPercentile":0.2896,"ingestedAt":"2026-07-08T18:25:49.185Z","slug":"CVE-2024-27320","body":"## Overview\n\nAn arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.\n\n## Affected packages\n\n- `refuel-autolabel >= 0.0.8, <= 0.0.16`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}