CVE Feed

    Dashboard / CVE / CVE-2024-29189

    CVE-2024-29189

    PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.

    Published:Mar 26, 2024
    Last Modified:Dec 15, 2025
    EPS:Mar 26, 2024
    EPSS Score:0.00084
    CVSS Score:7.4

    Affected Products

    Vendor
    Ansys
    Product
    Pyansys Geometry

    Exploits

    https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vmhttps://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm

    References

    https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html
    https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428
    https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc
    https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f
    https://github.com/ansys/pyansys-geometry/pull/1076
    https://github.com/ansys/pyansys-geometry/pull/1077
    https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm
    https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html
    https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428
    https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc
    https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f
    https://github.com/ansys/pyansys-geometry/pull/1076
    https://github.com/ansys/pyansys-geometry/pull/1077
    https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High