---
id: CVE-2023-47631
aliases:
  - GHSA-vc3v-ppc7-v486
  - PYSEC-2023-303
  - PYSEC-2023-304
title: vantage6-server node accepts non-whitelisted algorithms from malicious server
summary: vantage6-server node accepts non-whitelisted algorithms from malicious server
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
vendor: vantage6-server
product: vantage6-server
ecosystem: pip
affected:
  - vantage6-server < 4.1.2
  - vantage6-node < 4.1.2
patched:
  - vantage6-server 4.1.2
  - vantage6-node 4.1.2
published: '2023-11-14'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:59.258372908Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vc3v-ppc7-v486'
references:
  - url: >-
      https://github.com/vantage6/vantage6/security/advisories/GHSA-vc3v-ppc7-v486
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-47631'
  - url: >-
      https://github.com/vantage6/vantage6/commit/bf83521eb12fa80aa5fc92ef1692010a9a7f8243
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-node/PYSEC-2023-303.yaml
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2023-304.yaml
  - url: 'https://github.com/vantage6/vantage6'
  - url: >-
      https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268
tags:
  - osv
  - pip
epss: 0.00446
epssPercentile: 0.36053
ingestedAt: '2026-09-12T03:13:01.730Z'
---

## Overview

### Impact
A node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. Relevant node code [here](https://github.com/vantage6/vantage6/blob/version/4.1.1/vantage6-node/vantage6/node/docker/docker_manager.py#L265-L268)

This impacts all servers that are breached by an expert user

### Patches
Fixed in v4.1.2

### Workarounds
None



## Affected packages

- `vantage6-server < 4.1.2`
- `vantage6-node < 4.1.2`

## Remediation

Upgrade to a patched release:

- `vantage6-server 4.1.2`
- `vantage6-node 4.1.2`