CVE catalog
CVE-2023-41334
astropy: CVE-2023-41334
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.13% · Oct 25, 2026
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`. Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | astropy | sid | 8.0.1-3 | fixed |
| Debian | astropy | forky | 8.0.1-3 | fixed |
| Debian | astropy | trixie | 7.0.1-3 | fixed |
| Debian | astropy | bookworm | 5.2.1-2+deb12u1 | vulnerable |
| Opensuse | python-astropy | tumbleweed | 8.0.1-1.1 | fixed |
| Ubuntu | astropy | 18.04 | 3.0-3 | vulnerable |
| Ubuntu | astropy | 20.04 | 3.2.1-1build1 | vulnerable |
| Ubuntu | astropy | 20.04 | 3.2.2-1ubuntu1 | vulnerable |
| Ubuntu | astropy | 20.04 | 4.0-3 | vulnerable |
| Ubuntu | astropy | 20.04 | 4.0-4ubuntu1 | vulnerable |
| Ubuntu | astropy | 22.04 | 4.2-6ubuntu1 | vulnerable |
| Ubuntu | astropy | 22.04 | 5.0.1-1 | vulnerable |
| Ubuntu | astropy | 22.04 | 5.0.2-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | astropy | source | sid | 5.3.3-1 | not yet assigned | Not reported | Not reported |
| Debian | astropy | source | forky | 5.3.3-1 | not yet assigned | Not reported | Not reported |
| Debian | astropy | source | trixie | 5.3.3-1 | not yet assigned | Not reported | Not reported |
| Debian | astropy | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Opensuse | python-astropy | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2026:11353-1 | Not reported |
Notes
[bookworm] astropy: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11353-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-41334]
- [https://osv.dev/vulnerability/DLA-3803-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2023-41334]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11353-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-41334]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]