PyPI/pymatgen CVE-2024-23346: critical 9.3, EPSS 3.85%

pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

Action: Upgrade pymatgen to 2024.2.20 or later.

pip install pymatgen==2024.2.20

Affected

Fixed versions

Sources

• osv: GHSA-vgv8-5cpj-qj2f
• https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f
• https://nvd.nist.gov/vuln/detail/CVE-2024-23346
• https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a
• https://github.com/materialsproject/pymatgen
• https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108
• https://github.com/pypa/advisory-database/tree/main/vulns/pymatgen/PYSEC-2024-226.yaml
• https://www.vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346

CVE-2024-23346 · published 2024-02-21T18:04:00Z · modified 2026-06-10T17:14:18.255748286Z · JSON