id: PYSEC-2023-179
modified: 2023-09-28T10:29:02.604249Z
published: 2023-09-28T05:15:00Z
aliases:
- CVE-2023-26145
- GHSA-8mjr-6c96-39w8
details: "This affects versions of the package pydash before 6.0.0. A number of pydash
  methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept
  dotted paths (Deep Path Strings) to target a nested Python object, relative to the
  original source object. These paths can be used to target internal class attributes
  and dict items, to retrieve, modify or invoke nested Python objects.\r\r**Note:**\r
  \rThe pydash.objects.invoke() method is vulnerable to Command Injection when the
  following prerequisites are satisfied:\r\r1) The source object (argument 1) is not
  a built-in object such as list/dict (otherwise, the __init__.__globals__ path is
  not accessible)\r\r2) The attacker has control over argument 2 (the path string)
  and argument 3 (the argument to pass to the invoked method)\r\r\rThe pydash.collections.invoke_map()
  method is also vulnerable, but is harder to exploit as the attacker does not have
  direct control over the argument to be passed to the invoked function."
affected:
- package:
    ecosystem: PyPI
    name: pydash
    purl: pkg:pypi/pydash
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 6ff0831ad285fff937cafd2a853f20cc9ae92021
    repo: https://github.com/dgilland/pydash
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 6.0.0
  versions:
  - 0.0.0
  - 1.0.0
  - 1.1.0
  - 2.0.0
  - 2.1.0
  - 2.2.0
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 3.0.1
  - 3.1.0
  - 3.2.0
  - 3.2.1
  - 3.2.2
  - 3.3.0
  - 3.4.0
  - 3.4.1
  - 3.4.2
  - 3.4.3
  - 3.4.4
  - 3.4.5
  - 3.4.6
  - 3.4.7
  - 3.4.8
  - 4.0.0
  - 4.0.1
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.1.0
  - 4.2.0
  - 4.2.1
  - 4.3.0
  - 4.3.1
  - 4.3.2
  - 4.3.3
  - 4.4.0
  - 4.4.1
  - 4.5.0
  - 4.6.0
  - 4.6.1
  - 4.7.0
  - 4.7.1
  - 4.7.3
  - 4.7.4
  - 4.7.5
  - 4.7.6
  - 4.8.0
  - 4.9.0
  - 4.9.1
  - 4.9.2
  - 4.9.3
  - 5.0.0
  - 5.0.1
  - 5.0.2
  - 5.1.0
  - 5.1.1
  - 5.1.2
references:
- type: FIX
  url: 
    https://github.com/dgilland/pydash/commit/6ff0831ad285fff937cafd2a853f20cc9ae92021
- type: WEB
  url: https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca
- type: WEB
  url: https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8mjr-6c96-39w8