Skip to content
Fencer Vulns
high 7.1

CVE-2023-35932 json

jcvi vulnerable to Configuration Injection due to unsanitized user input

published 2023-06-23 3 y ago modified 2026-09-10 1 mo ago also GHSA-x49m-3cw7-gq5q , PYSEC-2026-1470 , EUVD-2023-1913

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is for instance shell code execution from the configuration file values. This vulnerability does not currently have a fix.

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
23 mo ago

Exploit prediction

1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
OSV 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected packages

ecosystem package affected fixed in
pypi jcvi
<=1.3.5
 no fix listed

Affected products

  • tanghaibao jcvi

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.