CVE-2018-8097: Code Injection in Eve (pyeve)
Summary
CVE-2018-8097: io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter. Affects eve across 2 version ranges.
< 0.7.5
< f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98
Fixed in f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eve (pyeve) is a Python package available on PyPI that provides a framework for building RESTful APIs. It is commonly used for creating web applications and services. The package allows developers to define data models and endpoints, which can be accessed through HTTP requests. However, a vulnerability has been discovered in versions prior to 0.7.5 that allows remote attackers to execute arbitrary code through code injection in the 'where' parameter of the 'io/mongo/parser.py' module.
Vulnerability Detail
The vulnerability arises due to insufficient input validation in the 'io/mongo/parser.py' module of Eve. Attackers can exploit this by injecting malicious code into the 'where' parameter, which is then executed by the application. This can lead to various security risks, including unauthorized access, data manipulation, and remote code execution. It is important to note that this vulnerability affects versions of Eve prior to 0.7.5.
How To Fix
Latest published version: 2.3.1 as of 23 Oct 2026
pip install --upgrade "eve==2.3.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98
This is the first release that contains the fix.
pip install --upgrade "eve==f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
In conclusion, CVE-2018-8097 is a code injection vulnerability in the Eve (pyeve) package prior to version 0.7.5. It allows remote attackers to execute arbitrary code by injecting malicious code into the 'where' parameter. To mitigate this vulnerability, it is crucial to update the Eve package to version 0.7.5 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for eve →
FAQ
Eve is a Python package that provides a framework for building RESTful APIs. It simplifies the process of creating web applications and services.
Code injection is a type of security vulnerability where an attacker can insert and execute malicious code within an application.
Attackers can exploit this vulnerability by injecting malicious code into the 'where' parameter of the 'io/mongo/parser.py' module in Eve.
This vulnerability can lead to unauthorized access, data manipulation, and remote code execution, potentially compromising the security and integrity of the application.
Yes, updating the Eve package to version 0.7.5 or later will fix this vulnerability.
