SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.
CVE-2024-42360
CVSS base score
9.8 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-77
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
wurmlab sequenceserver
References
- github.com Patch
- github.com Vendor Advisory