---
id: CVE-2023-43364
aliases:
  - GHSA-66m2-493m-crh2
  - PYSEC-2023-262
title: Searchor CLI's Search vulnerable to Arbitrary Code using Eval
summary: Searchor CLI's Search vulnerable to Arbitrary Code using Eval
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: searchor
product: searchor
ecosystem: pip
affected:
  - searchor < 2.4.2
patched:
  - searchor 2.4.2
published: '2023-09-25'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-66m2-493m-crh2'
references:
  - url: >-
      https://github.com/ArjunSharda/Searchor/security/advisories/GHSA-66m2-493m-crh2
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-43364'
  - url: 'https://github.com/ArjunSharda/Searchor/pull/130'
  - url: >-
      https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b
  - url: 'https://github.com/ArjunSharda/Searchor'
  - url: 'https://github.com/advisories/GHSA-66m2-493m-crh2'
  - url: 'https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-'
  - url: >-
      https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/searchor/PYSEC-2023-262.yaml
tags:
  - osv
  - pip
  - exploit-available
epss: 0.02565
epssPercentile: 0.84451
ingestedAt: '2026-07-08T18:25:46.296Z'
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/libertycityhacker/CVE-2023-43364-Exploit-CVE'
    - 'https://github.com/Herick-Costa/CVE-2023-43364-Searchor-RCE-Exploit'
  checkedAt: '2026-09-24T07:52:50.099Z'
exploitAvailable: true
---

## Overview

 An issue in Arjun Sharda's Searchor before version v.2.4.2 allows an attacker to
 execute arbitrary code via a crafted script to the eval() function in Searchor's src/searchor/main.py file, affecting the search feature in Searchor's CLI (Command Line Interface).

### Impact
Versions equal to, or below 2.4.1 are affected.

### Patches
Versions above, or equal to 2.4.2 have patched the vulnerability.

### References
https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection
https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-
https://github.com/jonnyzar/POC-Searchor-2.4.2
https://github.com/ArjunSharda/Searchor/pull/130

## Affected packages

- `searchor < 2.4.2`

## Remediation

Upgrade to a patched release:

- `searchor 2.4.2`