CVE-2024-56327

pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.

• CWE-94

• https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c
• https://github.com/advisories/GHSA-4fg7-vxc8-qx5w
• https://github.com/woodruffw/pyrage/security/advisories/GHSA-47h8-jmp3-9f28

Published

Dec 19, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56321GoCD is a continuous deliver server. GoCD versions 18.9.0 th…3.8
• CVE-2024-56322GoCD is a continuous deliver server. GoCD versions 16.7.0 th…7.2
• CVE-2024-56323OpenFGA is an authorization/permission engine. IN OpenFGA v1…9.8
• CVE-2024-56324GoCD is a continuous deliver server. GoCD versions prior to …7.1
• CVE-2024-56325Authentication Bypass Issue If the path does not contain / …9.8
• CVE-2024-56326Jinja is an extensible templating engine. Prior to 3.1.5, An…7.8
• CVE-2024-56328Discourse is an open source platform for community discussio…6.1
• CVE-2024-56329Socialstream is a third-party package for Laravel Jetstream.…8.9
• CVE-2024-5633Longse model LBH30FE200W cameras, as well as products based …7.5
• CVE-2024-56330Stardust is a platform for streaming isolated desktop contai…9.3
• CVE-2024-56331Uptime Kuma is an open source, self-hosted monitoring tool. …6.8
• CVE-2024-56332Next.js is a React framework for building full-stack web app…5.3