CVE-2026-45579: DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

July 13, 2026

An remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input that allows any authenticated user to run code/commands on the DIRAC server as the system user running the DIRAC services.

References

github.com/DIRACGrid/DIRAC/security/advisories/GHSA-9jpv-c7p4-997x
github.com/advisories/GHSA-9jpv-c7p4-997x
nvd.nist.gov/vuln/detail/CVE-2026-45579
pypi.org/project/DIRAC/8.0.79
pypi.org/project/DIRAC/9.0.22
pypi.org/project/DIRAC/9.1.10

Code Behaviors & Features

Detect and mitigate CVE-2026-45579 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →