critical vulnerability

DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

Fix availableCritical · CVSS 9.9EPSS 1.2%

Published Jul 13, 2026 · updated Nov 10, 2026

What to do

Upgrade to a fixed version: DIRAC 8.0.79, DIRAC 9.0.22, DIRAC 9.1.10.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIDIRAC63,442 downloads/week

Vulnerable versions: >= 6, < 8.0.79
Fixed in: 8.0.79

Check your project: pip show DIRAC

PyPIDIRAC63,442 downloads/week

Vulnerable versions: >= 8.1.0a1, < 9.0.22
Fixed in: 9.0.22

Check your project: pip show DIRAC

PyPIDIRAC63,442 downloads/week

Vulnerable versions: >= 9.1.0, < 9.1.10
Fixed in: 9.1.10

Check your project: pip show DIRAC

Sources

GitHub Advisory GHSA-m4m7-4cw8-62j6
NVD CVE-2026-61667

CWE-89 Improper Neutralization of Special Elements used in an SQL Command · CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code

← All critical vulnerabilities