CVE-2026-81662
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-20
Validación incorrecta de entrada
Fecha de publicación:
27/08/2026
Última modificación:
28/08/2026
Descripción
*** Pendiente de traducción *** Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py.<br />
<br />
<br />
The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment:<br />
<br />
<br />
f&#39;{key} = {py_val}&#39;<br />
<br />
and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. <br />
<br />
Version impacted >=3.3.0
Impacto
Puntuación base 4.0
8.60
Gravedad 4.0
ALTA