Vulnerabilities in pkg:pypi/DIRAC

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7xw9-549r-8jrc",
  "modified" : "2026-07-13T18:38:13Z",
  "published" : "2026-07-13T18:38:13Z",
  "aliases" : [ ],
  "summary" : "DIRAC: SQL injection and lack of access control in PilotManager service",
  "details" : "### Details\nA number of the functions in PilotManager pass parameters directly through to the database layer, which then does not do any escaping on the parameters. For example setPilotStatus:\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/Service/PilotManagerHandler.py#L343-L349\n\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/DB/PilotAgentsDB.py#L117\n\nThis won't accept multiple statements separated by a semicolon, but a carefully crafted set of parameters containing SQL escapes would likely be able to change or return other database entries.\n\nFurther to this, the PilotManager access control is only set to \"authenticated\"; this allows these functions to be called by any user. This allows any user to manage (e.g. delete, read output of) any pilot pilot job:\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/ConfigTemplate.cfg#L111-L118\n\nThis is fixed by changing the SQL statements to use proper parameter substitution and providing a suitable set of access rules for the exported pilot management functions.\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "DIRAC"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6"
      }, {
        "fixed" : "8.0.79"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "DIRAC"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.1.0a1"
      }, {
        "fixed" : "9.0.22"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "DIRAC"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.1.0"
      }, {
        "fixed" : "9.1.10"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-7xw9-549r-8jrc"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/DIRACGrid/DIRAC"
  }, {
    "type" : "WEB",
    "url" : "https://pypi.org/project/DIRAC/8.0.79"
  }, {
    "type" : "WEB",
    "url" : "https://pypi.org/project/DIRAC/9.0.22"
  }, {
    "type" : "WEB",
    "url" : "https://pypi.org/project/DIRAC/9.1.10"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284", "CWE-89" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-13T18:38:13Z",
    "nvd_published_at" : null
  }
}