Riskcovery

CVE-2026-108944

repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection

State
Published
Severity
2.4 Low
Published
Oct 13, 2026
Updated
Oct 14, 2026
Reserved
Oct 11, 2026

Read the record on cve.org

Description

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_str of the file src/utils/model_utils.py of the component Config-Driven Model Instantiation. Such manipulation of the argument Target leads to code injection. The attack must be carried out locally. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSSScoreVectorSource
4.02.4 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:XVulDB
3.14.8 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:CVulDB
3.04.8 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:CVulDB
2.04.3 MediumAV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:CVulDB

Weaknesses

Affected Products

ProductVersions
RAErepository
  • a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.