Vulnerability-Lookup

CVE-2026-45579 (GCVE-0-2026-45579)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:23 – Updated: 2026-09-15 18:48

Title

DIRAC: RCE in RequestManager due to eval on untrusted input

Summary

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 18:44 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/DIRACGrid/DIRAC/security/advis…	x_refsource_CONFIRM
https://github.com/DIRACGrid/DIRAC/commit/8ec1107…	x_refsource_MISC
https://github.com/DIRACGrid/DIRAC/commit/99f1af8…	x_refsource_MISC
https://github.com/DIRACGrid/DIRAC/commit/a6f75ce…	x_refsource_MISC
https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79	x_refsource_MISC
https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22	x_refsource_MISC
https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
DIRACGrid	DIRAC	Affected: >= 6r0, < 8.0.79 Affected: >= 9.0.0a1, < 9.0.22 Affected: >= 9.1.0, < 9.1.10	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45579",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:44:59.185443Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T18:48:26.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DIRAC",
          "vendor": "DIRACGrid",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6r0, \u003c 8.0.79"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0a1, \u003c 9.0.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.1.0, \u003c 9.1.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:23:34.557Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/commit/8ec11072f48103d94e8b7cca831e2c7ce304d6c7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/commit/8ec11072f48103d94e8b7cca831e2c7ce304d6c7"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/commit/99f1af88b525e69a77f204aebf7d8df3b6056142",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/commit/99f1af88b525e69a77f204aebf7d8df3b6056142"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/commit/a6f75ce5d369254d46ca6f1d39e3f384366fa396",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/commit/a6f75ce5d369254d46ca6f1d39e3f384366fa396"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22"
        },
        {
          "name": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10"
        }
      ],
      "source": {
        "advisory": "GHSA-9jpv-c7p4-997x",
        "discovery": "UNKNOWN"
      },
      "title": "DIRAC: RCE in RequestManager due to eval on untrusted input"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45579",
    "datePublished": "2026-09-15T17:23:34.557Z",
    "dateReserved": "2026-05-12T19:00:14.600Z",
    "dateUpdated": "2026-09-15T18:48:26.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45579",
      "date": "2026-09-16",
      "epss": "0.00438",
      "percentile": "0.373"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45579\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-15T18:17:21.427\",\"lastModified\":\"2026-09-15T19:17:19.743\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"DIRACGrid\",\"product\":\"DIRAC\",\"versions\":[{\"version\":\"\u003e= 6r0, \u003c 8.0.79\",\"status\":\"affected\"},{\"version\":\"\u003e= 9.0.0a1, \u003c 9.0.22\",\"status\":\"affected\"},{\"version\":\"\u003e= 9.1.0, \u003c 9.1.10\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T18:44:59.185443Z\",\"id\":\"CVE-2026-45579\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-95\"}]}],\"references\":[{\"url\":\"https://github.com/DIRACGrid/DIRAC/commit/8ec11072f48103d94e8b7cca831e2c7ce304d6c7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/DIRACGrid/DIRAC/commit/99f1af88b525e69a77f204aebf7d8df3b6056142\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/DIRACGrid/DIRAC/commit/a6f75ce5d369254d46ca6f1d39e3f384366fa396\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45579\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T18:44:59.185443Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T18:45:05.436Z\"}}], \"cna\": {\"title\": \"DIRAC: RCE in RequestManager due to eval on untrusted input\", \"source\": {\"advisory\": \"GHSA-9jpv-c7p4-997x\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"DIRACGrid\", \"product\": \"DIRAC\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 6r0, \u003c 8.0.79\"}, {\"status\": \"affected\", \"version\": \"\u003e= 9.0.0a1, \u003c 9.0.22\"}, {\"status\": \"affected\", \"version\": \"\u003e= 9.1.0, \u003c 9.1.10\"}]}], \"references\": [{\"url\": \"https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x\", \"name\": \"https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/DIRACGrid/DIRAC/commit/8ec11072f48103d94e8b7cca831e2c7ce304d6c7\", \"name\": \"https://github.com/DIRACGrid/DIRAC/commit/8ec11072f48103d94e8b7cca831e2c7ce304d6c7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/DIRACGrid/DIRAC/commit/99f1af88b525e69a77f204aebf7d8df3b6056142\", \"name\": \"https://github.com/DIRACGrid/DIRAC/commit/99f1af88b525e69a77f204aebf7d8df3b6056142\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/DIRACGrid/DIRAC/commit/a6f75ce5d369254d46ca6f1d39e3f384366fa396\", \"name\": \"https://github.com/DIRACGrid/DIRAC/commit/a6f75ce5d369254d46ca6f1d39e3f384366fa396\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79\", \"name\": \"https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22\", \"name\": \"https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10\", \"name\": \"https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-95\", \"description\": \"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-15T17:23:34.557Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45579\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T18:48:26.192Z\", \"dateReserved\": \"2026-05-12T19:00:14.600Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-15T17:23:34.557Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45579

Vulnerability from fkie_nvd - Published: 2026-09-15 18:17 - Updated: 2026-09-15 19:17

Severity

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/DIRACGrid/DIRAC/commit/8ec11072f48103d94e8b7cca831e2c7ce304d6c7
	security-advisories@github.com	https://github.com/DIRACGrid/DIRAC/commit/99f1af88b525e69a77f204aebf7d8df3b6056142
	security-advisories@github.com	https://github.com/DIRACGrid/DIRAC/commit/a6f75ce5d369254d46ca6f1d39e3f384366fa396
	security-advisories@github.com	https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79
	security-advisories@github.com	https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22
	security-advisories@github.com	https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10
	security-advisories@github.com	https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "DIRAC",
          "vendor": "DIRACGrid",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6r0, \u003c 8.0.79"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0a1, \u003c 9.0.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.1.0, \u003c 9.1.10"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10."
    }
  ],
  "id": "CVE-2026-45579",
  "lastModified": "2026-09-15T19:17:19.743",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45579",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T18:44:59.185443Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T18:17:21.427",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DIRACGrid/DIRAC/commit/8ec11072f48103d94e8b7cca831e2c7ce304d6c7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DIRACGrid/DIRAC/commit/99f1af88b525e69a77f204aebf7d8df3b6056142"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DIRACGrid/DIRAC/commit/a6f75ce5d369254d46ca6f1d39e3f384366fa396"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-95"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9JPV-C7P4-997X

Vulnerability from github – Published: 2026-07-13 17:20 – Updated: 2026-07-13 17:20

Summary

DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

Details

Summary

An remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input that allows any authenticated user to run code/commands on the DIRAC server as the system user running the DIRAC services.

Details

The export_getRequestCountersWeb function is callable by any authenticated user and just passes its parameters directly to the database instance: https://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/RequestManagementSystem/Service/ReqManagerHandler.py#L270

If the groupingAttribute string is unrecognised, Request. is prepended to it and the result is passed into an eval() call: https://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/RequestManagementSystem/DB/RequestDB.py#L766-L776

By passing in a dunder string that is applicable to the Request object, it's possible to work back up to functions in the os module and trigger them to be called in the server context.

There are other uses of eval in ReqManager/RequestDB which may be equally accessible.

Impact

This allows any authenticated user to run commands on the server, which allows a full compromise of the DIRAC system (they can read the local dirac.cfg, get database passwords and export all stored proxies and tokens). If local logging is used, they can also remove evidence of the exploit from the log (it leaves an exception printout in the RequestManager log when used).

Patched versions:

https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/ https://pypi.org/project/DIRAC/9.1.10/

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "DIRAC"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6"
            },
            {
              "fixed": "8.0.79"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "DIRAC"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0a1"
            },
            {
              "fixed": "9.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "DIRAC"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.1.0"
            },
            {
              "fixed": "9.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-13T17:20:18Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nAn remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input that allows any authenticated user to run code/commands on the DIRAC server as the system user running the DIRAC services.\n\n### Details\nThe export_getRequestCountersWeb function is callable by any authenticated user and just passes its parameters directly to the database instance:\nhttps://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/RequestManagementSystem/Service/ReqManagerHandler.py#L270\n\nIf the groupingAttribute string is unrecognised, `Request.` is prepended to it and the result is passed into an `eval()` call:\nhttps://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/RequestManagementSystem/DB/RequestDB.py#L766-L776\n\nBy passing in a dunder string that is applicable to the Request object, it\u0027s possible to work back up to functions in the os module and trigger them to be called in the server context.\n\nThere are other uses of eval in ReqManager/RequestDB which may be equally accessible.\n\n### Impact\nThis allows any authenticated user to run commands on the server, which allows a full compromise of the DIRAC system (they can read the local dirac.cfg, get database passwords and export all stored proxies and tokens). If local logging is used, they can also remove evidence of the exploit from the log (it leaves an exception printout in the RequestManager log when used).\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/",
  "id": "GHSA-9jpv-c7p4-997x",
  "modified": "2026-07-13T17:20:19Z",
  "published": "2026-07-13T17:20:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DIRACGrid/DIRAC"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/DIRAC/8.0.79"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/DIRAC/9.0.22"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/DIRAC/9.1.10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input"
}

PYSEC-2026-3462

Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:31

Details

Summary

Details

By passing in a dunder string that is applicable to the Request object, it's possible to work back up to functions in the os module and trigger them to be called in the server context.

There are other uses of eval in ReqManager/RequestDB which may be equally accessible.

Impact

Patched versions:

https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/ https://pypi.org/project/DIRAC/9.1.10/

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Impacted products

Name	purl
dirac	pkg:pypi/dirac

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dirac",
        "purl": "pkg:pypi/dirac"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6"
            },
            {
              "fixed": "8.0.79"
            },
            {
              "introduced": "8.1.0a1"
            },
            {
              "fixed": "9.0.22"
            },
            {
              "introduced": "9.1.0"
            },
            {
              "fixed": "9.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.2.0",
        "7.2.0a32",
        "7.2.0a33",
        "7.2.0a34",
        "7.2.0a35",
        "7.2.0a36",
        "7.2.0a38",
        "7.2.0a39",
        "7.2.1",
        "7.2.10",
        "7.2.12",
        "7.2.13",
        "7.2.14",
        "7.2.15",
        "7.2.16",
        "7.2.19",
        "7.2.2",
        "7.2.20",
        "7.2.21",
        "7.2.22",
        "7.2.23",
        "7.2.24",
        "7.2.25",
        "7.2.26",
        "7.2.27",
        "7.2.28",
        "7.2.3",
        "7.2.30",
        "7.2.31",
        "7.2.32",
        "7.2.33",
        "7.2.34",
        "7.2.35",
        "7.2.36",
        "7.2.37",
        "7.2.38",
        "7.2.39",
        "7.2.4",
        "7.2.40",
        "7.2.41",
        "7.2.42",
        "7.2.43",
        "7.2.44",
        "7.2.45",
        "7.2.46",
        "7.2.47",
        "7.2.48",
        "7.2.49",
        "7.2.5",
        "7.2.50",
        "7.2.51",
        "7.2.52",
        "7.2.6",
        "7.2.7",
        "7.2.8",
        "7.2.9",
        "7.2a29",
        "7.3.0a10",
        "7.3.0a11",
        "7.3.0a13",
        "7.3.0a14",
        "7.3.0a15",
        "7.3.0a16",
        "7.3.0a17",
        "7.3.0a18",
        "7.3.0a19",
        "7.3.0a2",
        "7.3.0a20",
        "7.3.0a21",
        "7.3.0a22",
        "7.3.0a23",
        "7.3.0a24",
        "7.3.0a3",
        "7.3.0a4",
        "7.3.0a5",
        "7.3.0a6",
        "7.3.0a7",
        "7.3.0a8",
        "7.3.0a9",
        "7.3.1",
        "7.3.10",
        "7.3.11",
        "7.3.12",
        "7.3.13",
        "7.3.14",
        "7.3.15",
        "7.3.16",
        "7.3.17",
        "7.3.18",
        "7.3.19",
        "7.3.2",
        "7.3.20",
        "7.3.21",
        "7.3.22",
        "7.3.23",
        "7.3.24",
        "7.3.26",
        "7.3.27",
        "7.3.28",
        "7.3.29",
        "7.3.3",
        "7.3.30",
        "7.3.31",
        "7.3.32",
        "7.3.33",
        "7.3.34",
        "7.3.35",
        "7.3.36",
        "7.3.37",
        "7.3.38",
        "7.3.4",
        "7.3.5",
        "7.3.6",
        "7.3.7",
        "7.3.8",
        "7.3.9",
        "7.4.0a1",
        "8.0.0",
        "8.0.0a1",
        "8.0.0a10",
        "8.0.0a11",
        "8.0.0a12",
        "8.0.0a13",
        "8.0.0a14",
        "8.0.0a15",
        "8.0.0a16",
        "8.0.0a17",
        "8.0.0a18",
        "8.0.0a19",
        "8.0.0a20",
        "8.0.0a21",
        "8.0.0a22",
        "8.0.0a23",
        "8.0.0a24",
        "8.0.0a25",
        "8.0.0a26",
        "8.0.0a27",
        "8.0.0a28",
        "8.0.0a29",
        "8.0.0a5",
        "8.0.0a6",
        "8.0.0a7",
        "8.0.0a8",
        "8.0.0a9",
        "8.0.1",
        "8.0.10",
        "8.0.11",
        "8.0.12",
        "8.0.13",
        "8.0.14",
        "8.0.15",
        "8.0.16",
        "8.0.17",
        "8.0.18",
        "8.0.19",
        "8.0.2",
        "8.0.20",
        "8.0.21",
        "8.0.22",
        "8.0.23",
        "8.0.24",
        "8.0.25",
        "8.0.26",
        "8.0.27",
        "8.0.28",
        "8.0.29",
        "8.0.3",
        "8.0.30",
        "8.0.31",
        "8.0.32",
        "8.0.33",
        "8.0.34",
        "8.0.35",
        "8.0.36",
        "8.0.37",
        "8.0.38",
        "8.0.39",
        "8.0.4",
        "8.0.40",
        "8.0.41",
        "8.0.42",
        "8.0.43",
        "8.0.44",
        "8.0.45",
        "8.0.46",
        "8.0.47",
        "8.0.48",
        "8.0.49",
        "8.0.5",
        "8.0.50",
        "8.0.51",
        "8.0.52",
        "8.0.53",
        "8.0.54",
        "8.0.55",
        "8.0.56",
        "8.0.58",
        "8.0.59",
        "8.0.6",
        "8.0.60",
        "8.0.61",
        "8.0.62",
        "8.0.63",
        "8.0.64",
        "8.0.65",
        "8.0.66",
        "8.0.67",
        "8.0.68",
        "8.0.69",
        "8.0.7",
        "8.0.70",
        "8.0.71",
        "8.0.72",
        "8.0.73",
        "8.0.74",
        "8.0.75",
        "8.0.76",
        "8.0.77",
        "8.0.78",
        "8.0.8",
        "8.0.9",
        "8.1.0a1",
        "8.1.0a10",
        "8.1.0a11",
        "8.1.0a12",
        "8.1.0a13",
        "8.1.0a14",
        "8.1.0a15",
        "8.1.0a16",
        "8.1.0a17",
        "8.1.0a18",
        "8.1.0a19",
        "8.1.0a2",
        "8.1.0a20",
        "8.1.0a21",
        "8.1.0a22",
        "8.1.0a23",
        "8.1.0a3",
        "8.1.0a4",
        "8.1.0a5",
        "8.1.0a6",
        "8.1.0a7",
        "8.1.0a8",
        "8.1.0a9",
        "9.0.0",
        "9.0.0a1",
        "9.0.0a10",
        "9.0.0a11",
        "9.0.0a12",
        "9.0.0a13",
        "9.0.0a16",
        "9.0.0a17",
        "9.0.0a18",
        "9.0.0a19",
        "9.0.0a2",
        "9.0.0a20",
        "9.0.0a21",
        "9.0.0a22",
        "9.0.0a23",
        "9.0.0a24",
        "9.0.0a25",
        "9.0.0a26",
        "9.0.0a27",
        "9.0.0a28",
        "9.0.0a29",
        "9.0.0a3",
        "9.0.0a30",
        "9.0.0a31",
        "9.0.0a35",
        "9.0.0a36",
        "9.0.0a37",
        "9.0.0a38",
        "9.0.0a39",
        "9.0.0a4",
        "9.0.0a40",
        "9.0.0a41",
        "9.0.0a42",
        "9.0.0a43",
        "9.0.0a44",
        "9.0.0a45",
        "9.0.0a46",
        "9.0.0a47",
        "9.0.0a48",
        "9.0.0a49",
        "9.0.0a5",
        "9.0.0a50",
        "9.0.0a51",
        "9.0.0a52",
        "9.0.0a53",
        "9.0.0a54",
        "9.0.0a55",
        "9.0.0a56",
        "9.0.0a57",
        "9.0.0a58",
        "9.0.0a59",
        "9.0.0a6",
        "9.0.0a60",
        "9.0.0a61",
        "9.0.0a62",
        "9.0.0a63",
        "9.0.0a64",
        "9.0.0a66",
        "9.0.0a67",
        "9.0.0a68",
        "9.0.0a69",
        "9.0.0a70",
        "9.0.1",
        "9.0.10",
        "9.0.11",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.15",
        "9.0.16",
        "9.0.17",
        "9.0.18",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.4",
        "9.0.5",
        "9.0.6",
        "9.0.7",
        "9.0.8",
        "9.0.9",
        "9.1.0",
        "9.1.1",
        "9.1.2",
        "9.1.3",
        "9.1.4",
        "9.1.5",
        "9.1.6",
        "9.1.7",
        "9.1.8",
        "9.1.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45579",
    "GHSA-9jpv-c7p4-997x"
  ],
  "details": "### Summary\nAn remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input that allows any authenticated user to run code/commands on the DIRAC server as the system user running the DIRAC services.\n\n### Details\nThe export_getRequestCountersWeb function is callable by any authenticated user and just passes its parameters directly to the database instance:\nhttps://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/RequestManagementSystem/Service/ReqManagerHandler.py#L270\n\nIf the groupingAttribute string is unrecognised, `Request.` is prepended to it and the result is passed into an `eval()` call:\nhttps://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/RequestManagementSystem/DB/RequestDB.py#L766-L776\n\nBy passing in a dunder string that is applicable to the Request object, it\u0027s possible to work back up to functions in the os module and trigger them to be called in the server context.\n\nThere are other uses of eval in ReqManager/RequestDB which may be equally accessible.\n\n### Impact\nThis allows any authenticated user to run commands on the server, which allows a full compromise of the DIRAC system (they can read the local dirac.cfg, get database passwords and export all stored proxies and tokens). If local logging is used, they can also remove evidence of the exploit from the log (it leaves an exception printout in the RequestManager log when used).\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/",
  "id": "PYSEC-2026-3462",
  "modified": "2026-07-23T14:31:00.913094Z",
  "published": "2026-07-23T11:41:44.867037Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DIRACGrid/DIRAC"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/DIRAC/8.0.79"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/DIRAC/9.0.22"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/DIRAC/9.1.10"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/dirac"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-9jpv-c7p4-997x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45579"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-45579 (GCVE-0-2026-45579)

FKIE_CVE-2026-45579

GHSA-9JPV-C7P4-997X

Summary

Details

Impact

Patched versions:

PYSEC-2026-3462

Summary

Details

Impact

Patched versions:

Tags

Sightings

Nomenclature