id: PYSEC-2023-116
modified: 2023-07-18T16:37:19.127985Z
published: 2023-07-11T15:15:00Z
aliases:
- CVE-2023-37659
- GHSA-jx3q-5rgf-vrrr
details: xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).
affected:
- package:
    ecosystem: PyPI
    name: xalpha
    purl: pkg:pypi/xalpha
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.11.4
    - fixed: 0.11.9
  versions:
  - 0.11.4
  - 0.11.5
  - 0.11.6
  - 0.11.7
  - 0.11.8
references:
- type: EVIDENCE
  url: https://github.com/refraction-ray/xalpha/issues/175
- type: REPORT
  url: https://github.com/refraction-ray/xalpha/issues/175
- type: ADVISORY
  url: https://github.com/advisories/GHSA-jx3q-5rgf-vrrr