You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
PSA to users: Don't load untrusted input with Sorcar activated.
Sorcar uses the Python eval function a lot, and in unsafe ways. Pretty much everything involving arrays uses it, because "arrays" in Sorcar are represented as strings that are eval'd when they need to be used, though that's not the usage of eval.
PSA to users: Don't load untrusted input with Sorcar activated.
Sorcar uses the Python
eval
function a lot, and in unsafe ways. Pretty much everything involving arrays uses it, because "arrays" in Sorcar are represented as strings that areeval
'd when they need to be used, though that's not the usage of eval.Example: in
socket_base.py
:This is easily exploitable by altering the node or node tree name.
The text was updated successfully, but these errors were encountered: