CVE-2024-41961

Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which later flows into an `eval` sink which executes the code. Fixed in commit 8bce00be93b95a6512ff68fe86bf9554e486bc02.

• CWE-94

• https://github.com/sapcc/elektra/commit/49aea3b365082681558bf3bf7bf4a51766cfc44d
• https://github.com/sapcc/elektra/commit/8bce00be93b95a6512ff68fe86bf9554e486bc02
• https://github.com/sapcc/elektra/security/advisories/GHSA-6j2h-486h-487q

Published

Aug 1, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41956Soft Serve is a self-hostable Git server for the command lin…8.1
• CVE-2024-41957Vim is an open source command line text editor. Vim < v9.1.0…5.3
• CVE-2024-41958mailcow: dockerized is an open source groupware/email suite …7.2
• CVE-2024-41959mailcow: dockerized is an open source groupware/email suite …6.1
• CVE-2024-4196An improper input validation vulnerability was discovered i…9.8
• CVE-2024-41960mailcow: dockerized is an open source groupware/email suite …4.8
• CVE-2024-41962Bostr is an nostr relay aggregator proxy that acts like a re…6.3
• CVE-2024-41964Kirby is a CMS targeting designers and editors. Kirby allows…8.1
• CVE-2024-41965Vim is an open source command line text editor. double-free …4.2
• CVE-2024-41967A low privileged remote attacker may modify the boot mode co…8.1
• CVE-2024-41968A low privileged remote attacker may modify the docker setti…5.4
• CVE-2024-41969A low privileged remote attacker may modify the configuratio…8.8