CVE-2024-23346

Name of the Vulnerable Software and Affected Versions pymatgen versions prior to 2024.2.20

Description A critical security issue exists in the JonesFaithfulTransformation.from transformation str() method within the pymatgen library. This method insecurely utilizes eval() for processing input, enabling execution of arbitrary code when parsing untrusted input. The vulnerability can be exploited when parsing a maliciously-created CIF file.

Recommendations For pymatgen versions prior to 2024.2.20, update to version 2024.2.20 to resolve the issue. As a temporary workaround, consider avoiding the use of the JonesFaithfulTransformation.from transformation str() method until a patch is available.