Executive brief
DIRAC, a software framework for distributed computing, contains a vulnerability that allows any logged-in user to execute arbitrary commands on the server. This could lead to a total system compromise, including the theft of database passwords, configuration files, and security tokens. Attackers could also delete logs to hide their activities.
Technical details
An eval injection vulnerability (CWE-95) exists in the RequestManager component of DIRAC. The 'export_getRequestCountersWeb' function in 'ReqManagerHandler.py' accepts user-provided parameters and passes them to the database layer. In 'RequestDB.py', if a 'groupingAttribute' string is unrecognized, the application prepends 'Request.' to the string and passes it to a Python 'eval()' call. An authenticated attacker can provide a crafted dunder string to break out of the intended scope and access the 'os' module, leading to arbitrary command execution as the system user. Patches are available in versions 8.0.79, 9.0.22, and 9.1.10.
Affected products
- DIRACGrid DIRAC >= 6, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10
Timeline
- 2026-07-13: advisory: GitHub Advisory GHSA-9jpv-c7p4-997x published
- 2026-07-13: patched: Fixes released in versions 8.0.79, 9.0.22, and 9.1.10