Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

dirac

5 known vulnerabilities (3 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 3 critical, 2 high
Weekly downloads
67.5K
Registry
PyPI

Advisories 5

  • DIRAC: Pilot code downloaded over unverified HTTPS connection

    Affected: from 6.20.1, fixed in 8.0.79; from 8.1.0a1, fixed in 9.0.22; from 9.1.0, fixed in 9.1.10; from 6.20.1, fixed in 8.0.79; from 8.1.0a1, fixed in 9.0.22; from 9.1.0, fixed in 9.1.10.

  • CVE-2026-61667Critical 9.9

    DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

    Affected: from 6, fixed in 8.0.79; from 8.1.0a1, fixed in 9.0.22; from 9.1.0, fixed in 9.1.10; from 6, fixed in 8.0.79; from 8.1.0a1, fixed in 9.0.22; from 9.1.0, fixed in 9.1.10.

  • CVE-2026-45579Critical 9.9

    DIRAC: RCE in RequestManager due to eval on untrusted input

    Affected: from 6, fixed in 8.0.79; from 8.1.0a1, fixed in 9.0.22; from 9.1.0, fixed in 9.1.10; from 6, fixed in 8.0.79; from 8.1.0a1, fixed in 9.0.22; from 9.1.0, fixed in 9.1.10.

  • DIRAC: Unauthorized users can read proxy contents during generation

    Affected: fixed in 8.0.41.

  • CVE-2024-24825Critical 9.1

    TokenManager not checking permissions on cached tokens in DIRAC

    Affected: fixed in 8.0.37; from 8.0.0, fixed in 8.0.37.