CVE-2026-61667: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

July 13, 2026

The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution.

References

github.com/DIRACGrid/DIRAC/security/advisories/GHSA-m4m7-4cw8-62j6
github.com/advisories/GHSA-m4m7-4cw8-62j6
nvd.nist.gov/vuln/detail/CVE-2026-61667
pypi.org/project/DIRAC/8.0.79
pypi.org/project/DIRAC/9.0.22
pypi.org/project/DIRAC/9.1.10

Code Behaviors & Features

Detect and mitigate CVE-2026-61667 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →