CVE-2018-1000070

CVE-2018-1000070 is an eval injection vulnerability affecting Bitmessage PyBitmessage versions v0.6.2 and earlier, specifically within the constructObject function in src/messagetypes/__init__.py. This critical flaw allows for remote code execution. An attacker can exploit this by sending a specially crafted, malicious message over the Bitmessage network, which, upon processing by the victim, leads to arbitrary code execution. The vulnerability carries a high CVSS score of 8.8, indicating a severe risk with network-based, low-complexity exploitation requiring user interaction. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the vulnerability was patched in version v0.6.3.