Proposal: Case Study on CVE-2024-23346 (Code Injection in pymatgen)

Description
We propose to create a secure coding case study on CVE-2024-23346, a code injection vulnerability in pymatgen.
The core coding mistake is the use of Python’s eval() on untrusted input while parsing transformation strings from CIF files in JonesFaithfulTransformation.from_transformation_str(). A malicious CIF file can inject Python code that is executed during parsing, allowing arbitrary command execution.
This makes a strong case study because the vulnerable code path is concrete, the source code and fix are publicly available, and the prevention lessons are practical: avoid eval() on untrusted input, use purpose-built parsers, validate input with allowlists, and use automated checks to flag dangerous dynamic evaluation.
Relevant links:
CVE: CVE-2024-23346
GitHub Advisory: GHSA-vgv8-5cpj-qj2f
Source repository: materialsproject/pymatgen
Fix commit: c231cbd3d5147ee920a37b6ee9dd236b376bcf5a
Team Members:
Bhanu Prakash Reddy Ramidi (G01568334)
Samay Salveru (G01586013)

Start by reviewing the CVE, the pymatgen function JonesFaithfulTransformation.from_transformation_str(), and fix commit c231cbd3d5147ee920a37b6ee9dd236b376bcf5a. Define the case study around the vulnerable parsing path, the code injection impact, the fix, and prevention lessons. Done means a complete, educational case study is added to this repository, though its target file or format is not specified.