{"id":"CVE-2024-56327","aliases":["EUVD-2024-3551","GHSA-47h8-jmp3-9f28","PYSEC-2026-1839","UBUNTU-CVE-2024-56327","USN-8372-1"],"status":"published","title":"Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage","description":"pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00499,"percentile":0.43303,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-25","CWE-94"],"published":"2024-12-19T15:14:06Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"PyPI","package":"pyrage","fixed_in":["1.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"age","fixed_in":["1.1.1-1ubuntu0.24.04.3+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyrage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pyrage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}],"versions":["1.2.1","1.2.2"]},{"source":"osv","ecosystem":"PyPI","package":"pyrage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}],"versions":["1.2.1","1.2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"age","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu0.24.04.3+esm1"}]}],"versions":["1.1.1-1build1","1.1.1-1ubuntu0.24.04.1","1.1.1-1ubuntu0.24.04.2","1.1.1-1ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"age","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu0.24.04.3+esm1"}]}],"versions":["1.1.1-1build1","1.1.1-1ubuntu0.24.04.1","1.1.1-1ubuntu0.24.04.2","1.1.1-1ubuntu0.24.04.3"]}],"products":[{"vendor":"woodruffw","product":"pyrage"}],"references":[{"url":"https://github.com/woodruffw/pyrage/security/advisories/GHSA-47h8-jmp3-9f28","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c","tags":["x_refsource_MISC","advisory","web","report"]},{"url":"https://github.com/advisories/GHSA-4fg7-vxc8-qx5w","tags":["x_refsource_MISC","advisory","report"]},{"url":"https://github.com/str4d/rage/security/advisories/GHSA-4fg7-vxc8-qx5w","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56327","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-47h8-jmp3-9f28","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56327.json","tags":["advisory"]},{"url":"https://github.com/woodruffw/pyrage","tags":["package"]},{"url":"https://pypi.org/project/pyrage","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-56327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56327","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8372-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-56327","title":"Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage","description":"pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.","status":"published","published":"2024-12-19T22:24:37.174Z","modified":"2024-12-20T17:32:22.96Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:33:58.357949Z"}],"euvd":[{"id":"EUVD-2024-3551","description":"pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.","status":"published","published":"2024-12-19T22:24:37Z","modified":"2024-12-20T17:32:22Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T00:04:33.692832Z"}],"ghsa":[{"id":"GHSA-47h8-jmp3-9f28","title":"pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution","description":"`pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w.\n\nAll details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details.\n\nVersions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**.\n\nAn equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory [GHSA-32gq-x56h-299c](https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c).\n\nThanks to ⬡-49016 for reporting this issue.","status":"published","published":"2024-12-19T15:14:06Z","modified":"2024-12-20T18:35:12Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-25","CWE-94","CWE-1395"],"updated_at":"2026-11-02T14:38:26.167657Z"}],"nvd":[{"id":"CVE-2024-56327","description":"pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.","status":"published","published":"2024-12-19T23:15:07.147Z","modified":"2026-06-17T08:12:03.16Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:40.507978Z"}],"osv":[{"id":"CVE-2024-56327","title":"Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage","description":"pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.","status":"published","published":"2024-12-19T22:24:37.174Z","modified":"2026-10-28T02:30:40.026786473Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"GHSA-47h8-jmp3-9f28","title":"pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution","description":"`pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w.\n\nAll details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details.\n\nVersions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**.\n\nAn equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory [GHSA-32gq-x56h-299c](https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c).\n\nThanks to ⬡-49016 for reporting this issue.","status":"published","published":"2024-12-19T15:14:06Z","modified":"2026-07-07T17:57:07.259517861Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1395","CWE-25","CWE-94"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"PYSEC-2026-1839","title":"pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution","description":"`pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w.\n\nAll details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details.\n\nVersions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**.\n\nAn equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory [GHSA-32gq-x56h-299c](https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c).\n\nThanks to ⬡-49016 for reporting this issue.","status":"published","published":"2026-07-07T14:34:47.620501Z","modified":"2026-07-07T17:46:59.507577103Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2024-56327","description":"pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.","status":"published","published":"2024-12-19T23:15:00Z","modified":"2026-06-02T18:16:11.340279077Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:15.331356Z"},{"id":"USN-8372-1","title":"age vulnerability","description":"It was discovered that age did not properly validate plugin names. An\nattacker could possibly use this issue to cause execution of an\narbitrary program by supplying a crafted recipient or identity string.","status":"published","published":"2026-06-02T16:24:33Z","modified":"2026-06-02T20:18:00.767072869Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}