---
id: CVE-2024-53305
aliases:
  - GHSA-2689-cw26-6cpj
  - PYSEC-2026-2048
title: >-
  Whoogle allows attackers to execute arbitrary code via supplying a crafted
  search query
summary: >-
  Whoogle allows attackers to execute arbitrary code via supplying a crafted
  search query
severity: high
vendor: whoogle-search
product: whoogle-search
ecosystem: pip
affected:
  - whoogle-search < 0.9.1
patched:
  - whoogle-search 0.9.1
published: '2025-04-16'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2689-cw26-6cpj'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53305'
  - url: >-
      https://github.com/benbusby/whoogle-search/commit/223f00c3c0533423114f99b30c561278bc0b42ba
  - url: 'https://fern89.github.io/posts/whoogle-rce'
  - url: 'https://gist.github.com/fern89/ca5fe76ad81b4bc363e7341e523a1651'
  - url: 'https://github.com/benbusby/whoogle-search'
tags:
  - osv
  - pip
epss: 0.00584
epssPercentile: 0.45522
ingestedAt: '2026-07-08T18:25:44.154Z'
---

## Overview

An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query.

## Affected packages

- `whoogle-search < 0.9.1`

## Remediation

Upgrade to a patched release:

- `whoogle-search 0.9.1`