Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a network.
How could an attacker exploit this vulnerability? An attacker could exploit this issue by publishing a malicious package named “geneformer” to the public PyPI registry using the same name referenced in the project’s requirements file. If a user installs the affected open‑source project and the installation process retrieves this malicious package instead of an intended legitimate one, the attacker’s code could run on the user’s system during installation. This could allow the attacker to execute unauthorized code.
<a href="https://www.linkedin.com/in/shrinivasan-sekar-525837385/">Shrinivasan Sekar</a>, <a href="https://www.linkedin.com/in/lakshmi-vignesh-s/">Lakshmi Vignesh S</a>, <a href="https://www.linkedin.com/in/shrinivasan-sekar-525837385/">Shrinivasan Sekar</a>, <a href="https://www.linkedin.com/in/shrinivasan-sekar-525837385/">Shrinivasan Sekar</a>