THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-m4m7-4cw8-62j6 (critical) — DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

[GHSA] GHSA-m4m7-4cw8-62j6 (critical) — DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

highgithub_advisoriesPublished 2026-07-13

GHSA-m4m7-4cw8-62j6 Severity: critical CVE: CVE-2026-61667

DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

### Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote cod

Indicators of compromise

f7e0a3ac153315030fb3520e8ca747f013758967sha1
CVE-2026-61667cve
https://pypi.org/project/DIRAC/8.0.79/url
https://pypi.org/project/DIRAC/9.0.22/url
https://pypi.org/project/DIRAC/9.1.10/url

Original source: https://github.com/advisories/GHSA-m4m7-4cw8-62j6