{"id":"CVE-2024-27321","aliases":["GHSA-4fgp-7vvm-m4jf","PYSEC-2026-1869"],"title":"Refuel Autolab Eval Injection vulnerability","summary":"Refuel Autolab Eval Injection vulnerability","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"refuel-autolabel","product":"refuel-autolabel","ecosystem":"pip","affected":["refuel-autolabel >= 0.0.8, <= 0.0.16"],"published":"2024-09-12","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4fgp-7vvm-m4jf","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27321"},{"url":"https://github.com/refuel-ai/autolabel"},{"url":"https://github.com/refuel-ai/autolabel/blob/v0.0.16/src/autolabel/dataset/validation.py#L129-L146"},{"url":"https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel"}],"tags":["osv","pip"],"epss":0.00349,"epssPercentile":0.25867,"ingestedAt":"2026-07-08T18:25:45.475Z","slug":"CVE-2024-27321","body":"## Overview\n\nAn arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.\n\n## Affected packages\n\n- `refuel-autolabel >= 0.0.8, <= 0.0.16`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}