CVE-2019-17526

An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an __import__('os').popen('whoami').read() line. NOTE: the vendor's position is that the product is "vulnerable by design" and the current behavior will be retained

• CWE-78
• CWE-94

• https://gist.github.com/barrett092/0380a1c34c014e29b827d1f408381525Exploit, Third Party Advisory
• https://github.com/sagemath/sagecell/commits/masterPatch
• https://sethsec.blogspot.com/2016/11/exploiting-python-code-injection-in-web.htmlExploit, Third Party Advisory
• https://gist.github.com/barrett092/0380a1c34c014e29b827d1f408381525Exploit, Third Party Advisory
• https://github.com/sagemath/sagecell/commits/masterPatch
• https://sethsec.blogspot.com/2016/11/exploiting-python-code-injection-in-web.htmlExploit, Third Party Advisory

Published

Oct 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17520The Bluetooth Low Energy implementation on Texas Instruments…6.5
• CVE-2019-17521An issue was discovered in Landing-CMS 0.0.6. There is a CSR…6.5
• CVE-2019-17522A stored XSS vulnerability was discovered in Hotaru CMS v1.7…4.8
• CVE-2019-17523An XSS vulnerability on Technicolor TC7300 STFA.51.20 device…5.4
• CVE-2019-17524An XSS vulnerability on Technicolor TC7300 STFA.51.20 device…5.4
• CVE-2019-17525The login page on D-Link DIR-615 T1 20.10 devices allows rem…8.8
• CVE-2019-17527dataForDepandantField in models/custormfields.php in the JS …9.8
• CVE-2019-17528An issue was discovered in Bento4 1.5.1.0. There is a SEGV i…7.5
• CVE-2019-17529An issue was discovered in Bento4 1.5.1.0. There is a heap-b…7.8
• CVE-2019-1753A vulnerability in the web UI of Cisco IOS XE Software could…8.8
• CVE-2019-17530An issue was discovered in Bento4 1.5.1.0. There is a heap-b…7.8
• CVE-2019-17531A Polymorphic Typing issue was discovered in FasterXML jacks…9.8