{"action":"Upgrade pymatgen to 2024.2.20 or later.","affected":[{"fixed":"2024.2.20","introduced":"0"}],"component":"pymatgen","cve_ids":["CVE-2024-23346"],"ecosystem":"PyPI","epss":0.03848,"exploited":false,"fixed_versions":["2024.2.20"],"ghsa_id":"GHSA-vgv8-5cpj-qj2f","id":"tcs_01M5KG0659Z9ZX6EHC7T48YETF","modified_at":"2026-06-10T17:14:18.255748286Z","published_at":"2024-02-21T18:04:00Z","references":["https://osv.dev/vulnerability/GHSA-vgv8-5cpj-qj2f","https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f","https://nvd.nist.gov/vuln/detail/CVE-2024-23346","https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a","https://github.com/materialsproject/pymatgen","https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108","https://github.com/pypa/advisory-database/tree/main/vulns/pymatgen/PYSEC-2024-226.yaml","https://www.vicarius.io/vsociety/posts/critical-security-flaw-in-pymatgen-library-cve-2024-23346"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-vgv8-5cpj-qj2f","url":"https://osv.dev/vulnerability/GHSA-vgv8-5cpj-qj2f"}],"summary":"pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string"}