{"id":"CVE-2023-48699","aliases":[],"url":"https://o3.security/vulnerability/CVE-2023-48699","summary":"Eval Injection in fastbots","details":"### Impact\nAn attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function def __locator__(self, locator_name: str) in page.py. The vulnerable code that load and execute directly from the file without validation it's:\n```python\n return eval(self._bot.locator(self._page_name, locator_name))\n```\n\n### Patches\nIn order to mitigate this issue it's important to upgrade to fastbots version 0.1.5 or above. \n\n### References\n[Merge that fix also this issue](https://github.com/ubertidavide/fastbots/pull/3#issue-2003080806)","published":"2023-11-21T22:18:22Z","modified":"2026-09-10T03:49:47.849235707Z","cvss":{"score":8.4,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"fastbots","fixedVersion":"0.1.5"}],"fix":{"url":"https://github.com/ubertidavide/fastbots/pull/3#issue-2003080806","label":"ubertidavide/fastbots#3"},"references":[{"type":"WEB","url":"https://github.com/ubertidavide/fastbots/security/advisories/GHSA-vccg-f4gp-45x9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48699"},{"type":"WEB","url":"https://github.com/ubertidavide/fastbots/pull/3#issue-2003080806"},{"type":"WEB","url":"https://github.com/ubertidavide/fastbots/commit/73eb03bd75365e112b39877e26ef52853f5e9f57"},{"type":"PACKAGE","url":"https://github.com/ubertidavide/fastbots"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:49:47.849235707Z"}}