{"id":"GHSA-vccg-f4gp-45x9","summary":"Eval Injection in fastbots","details":"### Impact\nAn attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function def __locator__(self, locator_name: str) in page.py. The vulnerable code that load and execute directly from the file without validation it's:\n```python\n return eval(self._bot.locator(self._page_name, locator_name))\n```\n\n### Patches\nIn order to mitigate this issue it's important to upgrade to fastbots version 0.1.5 or above. \n\n### References\n[Merge that fix also this issue](https://github.com/ubertidavide/fastbots/pull/3#issue-2003080806)","aliases":["CVE-2023-48699"],"modified":"2026-09-10T03:49:47.849235707Z","published":"2023-11-21T22:18:22Z","database_specific":{"nvd_published_at":"2023-11-21T23:15:08Z","cwe_ids":["CWE-94","CWE-95"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-11-21T22:18:22Z"},"references":[{"type":"WEB","url":"https://github.com/ubertidavide/fastbots/security/advisories/GHSA-vccg-f4gp-45x9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48699"},{"type":"WEB","url":"https://github.com/ubertidavide/fastbots/pull/3#issue-2003080806"},{"type":"WEB","url":"https://github.com/ubertidavide/fastbots/commit/73eb03bd75365e112b39877e26ef52853f5e9f57"},{"type":"PACKAGE","url":"https://github.com/ubertidavide/fastbots"}],"affected":[{"package":{"name":"fastbots","ecosystem":"PyPI","purl":"pkg:pypi/fastbots"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-vccg-f4gp-45x9/GHSA-vccg-f4gp-45x9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}