CVE-2024-29189: 
Python vulnerability analysis and mitigation

PyAnsys Geometry, a Python client library for the Ansys Geometry service and other CAD Ansys products, was found to contain a vulnerability in the file src/ansys/geometry/core/connection/product_instance.py. The vulnerability was discovered on March 25, 2024, and affects versions prior to 0.3.3 and 0.4.12. Upon calling the _start_program method directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran (GitHub Advisory).

The vulnerability stems from the improper usage of subprocess.Popen with shell=True in the _start_program method. This type of subprocess invocation is dangerous as it is vulnerable to various shell injection attacks. The issue was classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) with a CVSS v3.1 score of 7.4 (HIGH), having a vector string of CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory, Bandit Docs).

The vulnerability could allow attackers to perform malicious operations on the current machine where the script is executed. Given the CVSS metrics, the vulnerability could lead to high impacts on confidentiality, integrity, and availability of the system, though it requires local access and has high attack complexity (GitHub Advisory).

The vulnerability requires local access to exploit and has high attack complexity. It can be triggered by directly calling the _start_program method, which could then be used to execute arbitrary commands through shell injection (GitHub Advisory).

The vulnerability has been fixed in versions 0.3.3 and 0.4.12. The resolution was implemented through pull requests #1076 and #1077, which ensure that the method is only called from within the library and no longer enables the shell=True option. Users are recommended to upgrade to these patched versions (GitHub Advisory).