Skip to content

Arbitrary Code Execution via NumPy f2py Compilation

Description

Compiling arbitrary code can result in code execution. Ensure the source code is from a trusted location. The use of `numpy.f2py.compile()` can potentially lead to arbitrary code execution if the source code is not trusted.

Examples

Insecure Code

python
numpy.f2py.compile(user_input)

Secure Code

python
numpy.f2py.compile("trusted_source.py")

Remediation

Validate and sanitize the input to `numpy.f2py.compile()` to ensure it comes from a trusted source.

Rule Details

FieldValue
IDCODE-0489
CategoryInjection
SeverityCRITICAL
CWECWE-676
ConfidenceMEDIUM
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityMODERATE
Tagscode execution, arbitrary code
OWASPN/A

References