AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

iotdbGHSA-rxgg-273w-rfw7

Remote Code Execution vulnerability in Apache IoTDB via UDF

iotdb

CVE-2023-46226 · Published Jan 15, 2024 · updated Jun 20, 2025

High9.8
Fix: upgrade to 1.3.0 or later
GitHub advisory

Remote Code Execution vulnerability in Apache IoTDB. This issue affects Apache IoTDB from 1.0.0 through 1.2.2.

Users are recommended to upgrade to version 1.3.0, which fixes the issue.

Affected versions

PackageAffectedFixed in
apache-iotdb
PyPI
>= 1.0.0, < 1.3.01.3.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-94
Also known as
CVE-2023-46226, PYSEC-2024-11

More iotdb advisories

All iotdb
Critical 9.8May 14, 2025Apache IoTDB Vulnerable to Remote Code ExecutionCVE-2024-24780fixed in 1.3.4Critical 9.8Apr 17, 2023Apache IoTDB Grafana Connector vulnerable to Improper AuthenticationCVE-2023-24831fixed in 0.13.5Critical 9.8Apr 17, 2023iotdb: improper authorizationCVE-2023-30771no fix yetHigh 8.8Jan 31, 2023iotdb: improper authorizationCVE-2023-24829fixed in 0.13.3High 7.5Jan 30, 2023iotdb: improper authenticationCVE-2023-24830fixed in 0.13.3High 7.5Oct 26, 2022Apache IoTDB subject to ReDOS with Java 8CVE-2022-43766fixed in 0.13.3