{"id":"CVE-2024-27763","aliases":["EUVD-2024-24956","GHSA-86w8-vhw6-q9qq","PYSEC-2026-1215"],"status":"published","title":"XPixelGroup BasicSR Command Injection","description":"XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where \"scontrol show hostname\" is executed in the presence of a crafted SLURM_NODELIST environment variable.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00234,"percentile":0.14447,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2025-03-12T00:00:00Z","modified":"2026-10-28T02:31:00Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"basicsr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"basicsr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.2"}]}],"versions":["1.3.1","1.3.2","1.3.3","1.3.3.1","1.3.3.10","1.3.3.11","1.3.3.3","1.3.3.4","1.3.3.5","1.3.3.6","1.3.3.7","1.3.3.8","1.3.3.9","1.3.4.0","1.3.4.1","1.3.4.2","1.3.4.3","1.3.4.4","1.3.4.6","1.3.4.7","1.3.4.8","1.3.4.9","1.3.5","1.4.0","1.4.1","1.4.2"]},{"source":"osv","ecosystem":"PyPI","package":"basicsr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.2"}]}],"versions":["1.3.1","1.3.2","1.3.3","1.3.3.1","1.3.3.10","1.3.3.11","1.3.3.3","1.3.3.4","1.3.3.5","1.3.3.6","1.3.3.7","1.3.3.8","1.3.3.9","1.3.4.0","1.3.4.1","1.3.4.2","1.3.4.3","1.3.4.4","1.3.4.6","1.3.4.7","1.3.4.8","1.3.4.9","1.3.5","1.4.0","1.4.1","1.4.2"]}],"references":[{"url":"https://github.com/XPixelGroup/BasicSR/blob/master/basicsr/utils/dist_util.py#L44","tags":["web"]},{"url":"https://gist.github.com/aydinnyunus/40e1d8a3b529261ae654ff4891f1e192","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27763","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-86w8-vhw6-q9qq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27763.json","tags":["advisory"]},{"url":"https://github.com/XPixelGroup/BasicSR","tags":["package"]},{"url":"https://pypi.org/project/basicsr","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-27763","description":"XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where \"scontrol show hostname\" is executed in the presence of a crafted SLURM_NODELIST environment variable.","status":"published","published":"2025-03-12T00:00:00Z","modified":"2025-03-12T17:55:06.628Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:12.635756Z"}],"euvd":[{"id":"EUVD-2024-24956","description":"XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where \"scontrol show hostname\" is executed in the presence of a crafted SLURM_NODELIST environment variable.","status":"published","published":"2025-03-12T00:00:00Z","modified":"2025-03-12T17:55:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:05.95539Z"}],"ghsa":[{"id":"GHSA-86w8-vhw6-q9qq","title":"XPixelGroup BasicSR Command Injection","description":"XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where \"scontrol show hostname\" is executed in the presence of a crafted SLURM_NODELIST environment variable.","status":"published","published":"2025-03-12T15:32:06Z","modified":"2025-03-13T16:25:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:38:34.992855Z"}],"nvd":[{"id":"CVE-2024-27763","description":"XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where \"scontrol show hostname\" is executed in the presence of a crafted SLURM_NODELIST environment variable.","status":"published","published":"2025-03-12T15:15:39.433Z","modified":"2026-06-17T07:20:14.98Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:10:45.422466Z"}],"osv":[{"id":"CVE-2024-27763","description":"XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where \"scontrol show hostname\" is executed in the presence of a crafted SLURM_NODELIST environment variable.","status":"published","published":"2025-03-12T00:00:00Z","modified":"2026-10-28T02:31:00.478901514Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-86w8-vhw6-q9qq","title":"XPixelGroup BasicSR Command Injection","description":"XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where \"scontrol show hostname\" is executed in the presence of a crafted SLURM_NODELIST environment variable.","status":"published","published":"2025-03-12T15:32:06Z","modified":"2026-07-07T17:56:32.953825433Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"PYSEC-2026-1215","title":"XPixelGroup BasicSR Command Injection","description":"XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where \"scontrol show hostname\" is executed in the presence of a crafted SLURM_NODELIST environment variable.","status":"published","published":"2026-07-07T14:34:50.64426Z","modified":"2026-07-07T17:46:33.718618187Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"}]}}