-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the _start_program function's use of shell=True in subprocess.Popen. This setting allows shell command injection if any part of the 'args' parameter contains untrusted input. The conditional shell=True (enabled on non-Windows systems) combined with potential external control over arguments creates the vulnerability. The fix in the patches (#1076/#1077) explicitly removes shell=True and makes the method private to prevent direct exploitation, confirming this was the attack vector. CWE-78 and Bandit B602 documentation directly reference this pattern as dangerous.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ansys-geometry-core | pip | >= 0.3.0, < 0.3.3 | 0.3.3 |
| ansys-geometry-core | pip | >= 0.4.0, < 0.4.12 | 0.4.12 |