home / blog
2026-10-30 · critical
CVE-2023-43364: Arbitrary Code Execution in Searchor
CVSS 9.8 critical: Searchor < 2.4.2 executes arbitrary code from CLI input. Public exploit signals detected.
CVE-2023-43364 is a critical vulnerability in Searchor, a search tool used in CLI environments. The main.py file uses the eval() function directly on unauthenticated CLI input without validation, allowing attackers to execute arbitrary code by supplying malicious payloads as arguments. It affects all users of Searchor in versions prior to 2.4.2.
The CVSS score is 9.8 (critical). A patch was released in version 2.4.2. Public repositories declare containing exploit code for this CVE, reported on October 30, 2026. This public availability concretely increases the risk of exploitation in unpatched systems.
Administrators must immediately verify which version of Searchor is deployed across enterprise systems and apply the update to 2.4.2 or later with maximum priority. In the near term, if immediate patching is not feasible, restrict CLI access to trusted users and carefully monitor execution logs for anomalous behavior.
At a glance
- What
- main.py in Searchor < 2.4.2 uses eval() on CLI input without validation, enabling arbitrary code execution as per CVE-2023-43364. Any user submitting input via command line can trigger unauthorized code execution.
- Severity
- CVSS 9.8 (critical). Arbitrary code execution with the privileges of the user running Searchor.
- Affected versions
- Searchor before version 2.4.2
- Fix
- Update Searchor to version 2.4.2 or later
- Status
- Patch available. Public repositories declare containing exploit code for this CVE, reported 2026-10-30.
- Action
- Immediately verify which Searchor version is installed across enterprise systems. Deploy update to 2.4.2 or higher. If not immediately feasible, restrict CLI access to trusted users and monitor inputs and execution logs for anomalous behavior.
Sources: NVD, CVE-2023-43364