CVE-2025-4261 - GAIR-NLP factool tool.py run_single code injection

Back Back to CVE browser

MEDIUM

GAIR-NLP factool tool.py run_single code injection

Published May 5, 2025

4.8

MEDIUM

CVSS 4.0

EPSS 0.23%

Description

A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affects the function run_single of the file factool/factool/math/tool.py. The manipulation leads to code injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Affected products

Vendor Gair-Nlp Product Factool Default
n/a
- Version
  
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Gair-Nlp

Factool

n/a

Version	Status	Constraints
	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-94

Code Injection

References (5)

https://github.com/GAIR-NLP/factool/issues/50
issue-tracking
https://github.com/GAIR-NLP/factool/issues/50#issue-3007905464
exploitissue-tracking
https://vuldb.com/?ctiid.307365
signaturepermissions-required
https://vuldb.com/?id.307365
vdb-entrytechnical-description
https://vuldb.com/?submit.562942
third-party-advisory

Link	Providers	Tags
https://github.com/GAIR-NLP/factool/issues/50		issue-tracking
https://github.com/GAIR-NLP/factool/issues/50#issue-3007905464		exploitissue-tracking
https://vuldb.com/?ctiid.307365		signaturepermissions-required
https://vuldb.com/?id.307365		vdb-entrytechnical-description
https://vuldb.com/?submit.562942		third-party-advisory