{"id":"CVE-2023-43364","aliases":["EUVD-2023-0236","GHSA-66m2-493m-crh2","PYSEC-2023-262"],"status":"published","title":"Searchor CLI's Search vulnerable to Arbitrary Code using Eval","description":"main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02885,"percentile":0.8697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-74","CWE-94"],"published":"2023-09-25T18:37:51Z","modified":"2026-10-28T02:31:10Z","exploits":[{"source":"pocgithub","id":"Herick-Costa/CVE-2023-43364-Searchor-RCE-Exploit","title":"Herick-Costa/CVE-2023-43364-Searchor-RCE-Exploit","date":"2026-06-30","url":"https://github.com/Herick-Costa/CVE-2023-43364-Searchor-RCE-Exploit"},{"source":"pocgithub","id":"IamSaishi/CVE-2023-43364_Exploit","title":"IamSaishi/CVE-2023-43364_Exploit","date":"2026-09-29","url":"https://github.com/IamSaishi/CVE-2023-43364_Exploit"},{"source":"pocgithub","id":"diamorphine666/CVE-2023-43364","title":"diamorphine666/CVE-2023-43364","date":"2026-10-30","url":"https://github.com/diamorphine666/CVE-2023-43364"},{"source":"pocgithub","id":"libertycityhacker/CVE-2023-43364-Exploit-CVE","title":"libertycityhacker/CVE-2023-43364-Exploit-CVE","date":"2024-04-26","url":"https://github.com/libertycityhacker/CVE-2023-43364-Exploit-CVE"}],"fixes":[{"ecosystem":"PyPI","package":"searchor","fixed_in":["2.4.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"searchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.1"},{"fixed":"2.4.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"searchor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2"}]}],"versions":["1.0.3","1.0.4","1.0.5","1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","2.0.0","2.0.1","2.0.2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1"]},{"source":"osv","ecosystem":"PyPI","package":"searchor","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"16016506f7bf92b0f21f51841d599126d6fcd15b"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2"}]}],"versions":["1.0.3","1.0.4","1.0.5","1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","2.0.0","2.0.1","2.0.2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1"]}],"products":[{"vendor":"arjunsharda","product":"searchor"}],"references":[{"url":"https://github.com/ArjunSharda/Searchor/pull/130","tags":["x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-","tags":["x_transferred","Exploit","package","web","evidence"]},{"url":"https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection","tags":["x_transferred","Exploit","package","web","evidence"]},{"url":"https://github.com/advisories/GHSA-66m2-493m-crh2","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/ArjunSharda/Searchor/commit/16016506f7bf92b0f21f51841d599126d6fcd15b","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/ArjunSharda/Searchor/security/advisories/GHSA-66m2-493m-crh2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43364","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/searchor/PYSEC-2023-262.yaml","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43364.json","tags":["advisory"]},{"url":"https://github.com/ArjunSharda/Searchor","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-43364","description":"main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.","status":"published","published":"2023-12-12T00:00:00Z","modified":"2024-10-09T13:30:12.973Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:14.633899Z"}],"euvd":[{"id":"EUVD-2023-0236","description":"main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.","status":"published","published":"2023-12-12T00:00:00Z","modified":"2024-10-09T13:30:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:27:43.39457Z"}],"ghsa":[{"id":"GHSA-66m2-493m-crh2","title":"Searchor CLI's Search vulnerable to Arbitrary Code using Eval","description":" An issue in Arjun Sharda's Searchor before version v.2.4.2 allows an attacker to\n execute arbitrary code via a crafted script to the eval() function in Searchor's src/searchor/main.py file, affecting the search feature in Searchor's CLI (Command Line Interface).\n\n### Impact\nVersions equal to, or below 2.4.1 are affected.\n\n### Patches\nVersions above, or equal to 2.4.2 have patched the vulnerability.\n\n### References\nhttps://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection\nhttps://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-\nhttps://github.com/jonnyzar/POC-Searchor-2.4.2\nhttps://github.com/ArjunSharda/Searchor/pull/130","status":"published","published":"2023-09-25T18:37:51Z","modified":"2024-10-09T22:52:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2023-43364","description":"main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.","status":"published","published":"2023-12-12T18:15:22.887Z","modified":"2026-06-17T06:25:30.067Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:08:54.696438Z"}],"osv":[{"id":"CVE-2023-43364","description":"main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.","status":"published","published":"2023-12-12T00:00:00Z","modified":"2026-10-28T02:31:10.243103863Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-66m2-493m-crh2","title":"Searchor CLI's Search vulnerable to Arbitrary Code using Eval","description":" An issue in Arjun Sharda's Searchor before version v.2.4.2 allows an attacker to\n execute arbitrary code via a crafted script to the eval() function in Searchor's src/searchor/main.py file, affecting the search feature in Searchor's CLI (Command Line Interface).\n\n### Impact\nVersions equal to, or below 2.4.1 are affected.\n\n### Patches\nVersions above, or equal to 2.4.2 have patched the vulnerability.\n\n### References\nhttps://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection\nhttps://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-\nhttps://github.com/jonnyzar/POC-Searchor-2.4.2\nhttps://github.com/ArjunSharda/Searchor/pull/130","status":"published","published":"2023-09-25T18:37:51Z","modified":"2026-07-08T06:28:03.321528855Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"PYSEC-2023-262","description":"main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.","status":"published","published":"2023-12-12T18:15:00Z","modified":"2024-10-09T19:44:29.656862Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:53.837392Z"}]}}