OpenStack Vitrage Query Parser Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the query parser of OpenStack Vitrage versions prior to 12.0.1, 13.0.0, 14.0.0, and 15.0.0. This vulnerability allows a user with access to the Vitrage API to execute code on the host where the Vitrage service is running, potentially leading to unauthorized access and further compromise of the Vitrage service. The issue arises in the '_create_query_function' within 'vitrage/graph/query.py'.

Impact

Exploitation of this vulnerability allows for remote code execution on the Vitrage service host, as the user under which the Vitrage service runs.