PyPI/lightgbm CVE-2024-43598: high 8.1, EPSS 1.42%

LightGBM Remote Code Execution Vulnerability

Action: Upgrade lightgbm to 4.6.0 or later.

pip install lightgbm==4.6.0

Affected

Fixed versions

Sources

• osv: GHSA-2586-f3p4-hq84
• https://nvd.nist.gov/vuln/detail/CVE-2024-43598
• https://github.com/microsoft/LightGBM
• https://github.com/pypa/advisory-database/tree/main/vulns/lightgbm/PYSEC-2024-231.yaml
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598

CVE-2024-43598 · published 2024-11-12T18:30:58Z · modified 2025-02-18T19:41:59.478178Z · JSON