High · published December 9, 2025
🚨 An authenticated user with an "IDE role" can exploit a weakness in the SecOps SOAR server to execute arbitrary code! 🔥 Think of this like a restaurant allowing chefs to add their own recipes without checking the ingredients — a sneaky chef could whip up something dangerous without anyone stopping them! An attacker could upload a malicious Python package that executes during installation, potentially giving them full control over the server. This means they could steal sensitive data, disrupt services, or even pivot to other systems within your network — absolutely devastating consequences!
Think of this like a restaurant allowing chefs to add their own recipes without checking the ingredients — a sneaky chef could whip up something dangerous without anyone stopping them! This vulnerability arises from inadequate validation of uploaded Python package code, allowing a user with appropriate access to run any code included in a malicious setup.py file during installation.
An attacker could upload a malicious Python package that executes during installation, potentially giving them full control over the server. This means they could steal sensitive data, disrupt services, or even pivot to other systems within your network — absolutely devastating consequences! But don't fret! All customers have been automatically upgraded to the fixed version 6.3.64 or higher, which secures against this vulnerability. Make sure to verify your version to confirm you're protected! You've got this, security heroes! Keep your systems safe and stay vigilant! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| google/security_operations_soar | < 6.3.64 | 6.3.64 |