PyPI incidents

Malicious code in chroma-client (PyPI)

Malicious code in chroma-client (PyPI)

Malicious code in python-fork (PyPI)

Malicious code in python-fork (PyPI)

Malicious code in platform-telemetry-client (PyPI)

Malicious code in platform-telemetry-client (PyPI)

Malicious code in langgrap (PyPI)

Malicious code in langgrap (PyPI)

Malicious code in eth-account-web3 (PyPI)

Malicious code in eth-account-web3 (PyPI)

Malicious code in ollamaa (PyPI)

Malicious code in ollamaa (PyPI)

Malicious code in aitextutils-py (PyPI)

Malicious code in aitextutils-py (PyPI)

Malicious code in openaii (PyPI)

Malicious code in openaii (PyPI)

Malicious code in web3-eth-account (PyPI)

Malicious code in web3-eth-account (PyPI)

Malicious code in aitextkit-py (PyPI)

Malicious code in aitextkit-py (PyPI)

Malicious code in transfomers (PyPI)

Malicious code in transfomers (PyPI)

Malicious code in pymem-win (PyPI)

Malicious code in pymem-win (PyPI)

pytorch-lightning is vulnerable to Deserialization of Untrusted Data

pytorch-lightning is vulnerable to Deserialization of Untrusted Data

lightning: before 1.6.0

ChromaDB has a code injection vulnerability

ChromaDB has a code injection vulnerability

chromadb: ≥ 0.4.17

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse: before 0.6.0

praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

praisonaiagents: 1.5.128 → 1.6.58

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

copier: 9.5.0 → 9.15.2

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.

lightning: before 1.6.0

Snowflake Connector for Python improperly verifies TLS hostnames

Snowflake Connector for Python improperly verifies TLS hostnames

snowflake-connector-python: before 3.18.1

vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

vllm: 0.21.0 → 0.26.0

Malicious code in lucy-python-script-2030 (PyPI)

Malicious code in lucy-python-script-2030 (PyPI)

pypdf: Possible long runtimes/large memory usage when retrieving outlines

pypdf: Possible long runtimes/large memory usage when retrieving outlines

pypdf: before 6.16.1

Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

justhtml: before 1.10.0

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

pypdf: before 6.16.1

Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI: CORS misconfig enables localhost RCE

winml-cli: before 0.4.0

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

praisonai: before 4.6.58

Malicious code in pylever (PyPI)

Malicious code in pylever (PyPI)

WsgiDAV MySQL provider has a blind SQL injection

WsgiDAV MySQL provider has a blind SQL injection

wsgidav: before 4.3.5

pypdf: Possible infinite loop for TreeObject.insert_child

pypdf: Possible infinite loop for TreeObject.insert_child

pypdf: before 6.16.0

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk: before 3.10.3

pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf: before 6.15.0

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

protego: before 0.6.2

Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

banks: before 2.4.5

Malicious code in websetup (PyPI)

Malicious code in websetup (PyPI)

Malicious code in bq-build-probe-vrp-2026 (PyPI)

Malicious code in bq-build-probe-vrp-2026 (PyPI)

Malicious code in databricks-webapp-navigation-homepage (PyPI)

Malicious code in databricks-webapp-navigation-homepage (PyPI)

Malicious code in bq-sdist-probe-vrp (PyPI)

Malicious code in bq-sdist-probe-vrp (PyPI)

Malicious code in cv-train (PyPI)

Malicious code in cv-train (PyPI)

Malicious code in telegram-helper (PyPI)

Malicious code in telegram-helper (PyPI)

Malicious code in dac-tools (PyPI)

Malicious code in dac-tools (PyPI)

Malicious code in minecraftmodes (PyPI)

Malicious code in minecraftmodes (PyPI)

Malicious code in dbt-sa-cli (PyPI)

Malicious code in dbt-sa-cli (PyPI)

Malicious code in proxycer (PyPI)

Malicious code in proxycer (PyPI)

Malicious code in trongridew (PyPI)

Malicious code in trongridew (PyPI)

Malicious code in astlsi (PyPI)

Malicious code in astlsi (PyPI)

Malicious code in houdus (PyPI)

Malicious code in houdus (PyPI)

Malicious code in tsshare (PyPI)

Malicious code in tsshare (PyPI)

tsshare: all versions

Malicious code in tpu-raiden-jax (PyPI)

Malicious code in tpu-raiden-jax (PyPI)

Malicious code in pymaas (PyPI)

Malicious code in pymaas (PyPI)

Malicious code in metricboxlite (PyPI)

Malicious code in metricboxlite (PyPI)

Malicious code in chartkit-core (PyPI)

Malicious code in chartkit-core (PyPI)

Malicious code in timeweave (PyPI)

Malicious code in timeweave (PyPI)

Malicious code in olympuslib (PyPI)

Malicious code in olympuslib (PyPI)

Malicious code in qoeoe (PyPI)

Malicious code in qoeoe (PyPI)

Malicious code in 0requests (PyPI)

Malicious code in 0requests (PyPI)

Malicious code in py-1requests (PyPI)

Malicious code in py-1requests (PyPI)

Malicious code in company-sdk (PyPI)

Malicious code in company-sdk (PyPI)

Malicious code in py-0requests (PyPI)

Malicious code in py-0requests (PyPI)

Malicious code in uvhttp-custom (PyPI)

Malicious code in uvhttp-custom (PyPI)

Malicious code in asti (PyPI)

Malicious code in asti (PyPI)

Malicious code in env-validator-tool (PyPI)

Malicious code in env-validator-tool (PyPI)

Malicious code in telemetry-helper (PyPI)

Malicious code in telemetry-helper (PyPI)

Malicious code in py-2equests (PyPI)

Malicious code in py-2equests (PyPI)

Malicious code in trongridi (PyPI)

Malicious code in trongridi (PyPI)

Malicious code in gcphelpit (PyPI)

Malicious code in gcphelpit (PyPI)

Malicious code in syswatch (PyPI)

Malicious code in syswatch (PyPI)

Malicious code in tallyboxlite (PyPI)

Malicious code in tallyboxlite (PyPI)

Malicious code in pyservercheck (PyPI)

Malicious code in pyservercheck (PyPI)

Malicious code in trongridor (PyPI)

Malicious code in trongridor (PyPI)

Malicious code in tronlinker (PyPI)

Malicious code in tronlinker (PyPI)

Malicious code in auth-app-streamlit (PyPI)

Malicious code in auth-app-streamlit (PyPI)

Malicious code in flask-header-guard (PyPI)

Malicious code in flask-header-guard (PyPI)

Malicious code in yaml-report-formatter (PyPI)

Malicious code in yaml-report-formatter (PyPI)

Malicious code in calcboxlite (PyPI)

Malicious code in calcboxlite (PyPI)

Malicious code in yamlformatter-utils (PyPI)

Malicious code in yamlformatter-utils (PyPI)

Malicious code in yamlformat-tools (PyPI)

Malicious code in yamlformat-tools (PyPI)

Malicious code in pygame-renderkit (PyPI)

Malicious code in pygame-renderkit (PyPI)

Malicious code in mathkitlite (PyPI)

Malicious code in mathkitlite (PyPI)

Malicious code in flyteplugins-echo (PyPI)

Malicious code in flyteplugins-echo (PyPI)

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.

openssl-encrypt: before 1.4.9

Malicious code in flyteplugins-agento11y (PyPI)

Malicious code in flyteplugins-agento11y (PyPI)

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied vi

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output,

openssl-encrypt: before 1.4.9

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.

openssl-encrypt: before 1.4.9

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.

openssl-encrypt: before 1.4.9

Malicious code in ekx-report-utils (PyPI)

Malicious code in ekx-report-utils (PyPI)

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.

openssl-encrypt: before 1.4.9

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of th

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.

openssl-encrypt: before 1.4.9

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

openssl-encrypt: before 1.4.9

Malicious code in flyteplugins-nsight (PyPI)

Malicious code in flyteplugins-nsight (PyPI)

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, al

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

openssl-encrypt: before 1.4.9

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().

openssl-encrypt: before 1.4.9

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.

openssl-encrypt: before 1.4.9

In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to

In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.

openssl-encrypt: before 1.4.9

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloa

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.

nltk: before 3.10.3

openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file m

openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.

openssl-encrypt: before 1.4.9

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the p

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.

openssl-encrypt: before 1.4.9

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unau

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.

nltk: before 3.10.3

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attac

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.

nltk: before 3.10.3

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of serv

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causin

nltk: before 3.10.3

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.

openssl-encrypt: before 1.4.9

Malicious code in sap-quarterly-report (PyPI)

Malicious code in sap-quarterly-report (PyPI)

Malicious code in flyteplugins-redis (PyPI)

Malicious code in flyteplugins-redis (PyPI)

Malicious code in decoris (PyPI)

Malicious code in decoris (PyPI)

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by us

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

nltk: before 3.10.3

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSear

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

nltk: before 3.10.0

Malicious code in pybitjs (PyPI)

Malicious code in pybitjs (PyPI)

Malicious code in trongridet (PyPI)

Malicious code in trongridet (PyPI)

Malicious code in syntaxerror-package-12345 (PyPI)

Malicious code in syntaxerror-package-12345 (PyPI)

Malicious code in 0xfighter3 (PyPI)

Malicious code in 0xfighter3 (PyPI)

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing i

nltk: before 3.10.3

Malicious code in bigquery-agent-analytics-tracing (PyPI)

Malicious code in bigquery-agent-analytics-tracing (PyPI)

Malicious code in rce-test (PyPI)

Malicious code in rce-test (PyPI)

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

nltk: before 3.10.3

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, a

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.

nltk: before 3.10.3

Malicious code in minecraft-ytreceiver (PyPI)

Malicious code in minecraft-ytreceiver (PyPI)

Malicious code in python-walletlibr-v (PyPI)

Malicious code in python-walletlibr-v (PyPI)

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attack

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

nltk: before 3.10.3

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths usin

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms().

nltk: before 3.10.3

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entir

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.

nltk: before 3.10.3

NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the Transition

NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code wit

nltk: before 3.10.0

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.l

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an

nltk: before 3.10.3

Malicious code in multyproccess (PyPI)

Malicious code in multyproccess (PyPI)

Malicious code in msrcpoc (PyPI)

Malicious code in msrcpoc (PyPI)

Malicious code in py-devoli-common (PyPI)

Malicious code in py-devoli-common (PyPI)

Malicious code in envprovision (PyPI)

Malicious code in envprovision (PyPI)

Malicious code in cryptgraphy (PyPI)

Malicious code in cryptgraphy (PyPI)

Malicious code in mlflow-otel-instrumentor (PyPI)

Malicious code in mlflow-otel-instrumentor (PyPI)

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows at

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.

nltk: before 3.9.4

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compa

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

nltk: before 3.10.0

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.

nltk: before 3.9.4

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.E

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.

nltk: before 3.10.0

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

nltk: 3.10.0 → 3.10.2

Malicious code in scrambleeeer (PyPI)

Malicious code in scrambleeeer (PyPI)

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit wa

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

nltk: before 3.10.0

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the valid

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebin

nltk: before 3.10.0

Malicious code in scrambleeer (PyPI)

Malicious code in scrambleeer (PyPI)

Malicious code in requests-crypt (PyPI)

Malicious code in requests-crypt (PyPI)

Malicious code in boto4 (PyPI)

Malicious code in boto4 (PyPI)

Malicious code in reqcrypts (PyPI)

Malicious code in reqcrypts (PyPI)

Malicious code in reqcrypt-dev (PyPI)

Malicious code in reqcrypt-dev (PyPI)

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

ansible-jailexec: before 2.0.0

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

compliance-trestle: before 4.1.0

sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse: before 0.6.0

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6: all versions

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

sqlparse: before 0.6.0

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse: before 0.6.0

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab: 3.3.0 → 4.5.10

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

jupyterlab: before 4.5.10

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

glances: before 4.5.6

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab: 4.5.0 → 4.5.10

Malicious code in rc4-secure (PyPI)

Malicious code in rc4-secure (PyPI)

Malicious code in libasync (PyPI)

Malicious code in libasync (PyPI)

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

glances: before 4.5.6

Malicious code in deepface-weight (PyPI)

Malicious code in deepface-weight (PyPI)

Malicious code in reqcrypt (PyPI)

Malicious code in reqcrypt (PyPI)

Malicious code in deepface-weights (PyPI)

Malicious code in deepface-weights (PyPI)

Malicious code in httpz-requests (PyPI)

Malicious code in httpz-requests (PyPI)

Malicious code in infogram-bot (PyPI)

Malicious code in infogram-bot (PyPI)

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings access

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server ro

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed,

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a

openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMA

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call i

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after cl

openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles fr

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugi

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

openssl-encrypt: before 1.4.0

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accep

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation ch

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

openssl-encrypt: before 1.4.0

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hs

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to

openssl-encrypt: before 1.4.7

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Pyth

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementa

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. A

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that return

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugi

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared a

openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method th

openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, re

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configur

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

openssl-encrypt: before 1.4.0

openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silent

openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.

openssl-encrypt: before 1.4.0

Malicious code in kb-ai (PyPI)

Malicious code in kb-ai (PyPI)

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handl

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

gitpython: before 3.1.55

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keywor

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=<path>, causing 'git rev-list --output=<path>' to open and truncate the target file to zero bytes before revision parsing.

gitpython: before 3.1.56

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

gitpython: before 3.1.57

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file an

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

gitpython: before 3.1.57

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that ca

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.

gitpython: before 3.1.54

Malicious code in dlmm (PyPI)

Malicious code in dlmm (PyPI)

Malicious code in telebot-pro (PyPI)

Malicious code in telebot-pro (PyPI)

Malicious code in morpho-sdk (PyPI)

Malicious code in morpho-sdk (PyPI)

Malicious code in euler-sdk (PyPI)

Malicious code in euler-sdk (PyPI)

Malicious code in joule-btp-extension (PyPI)

Malicious code in joule-btp-extension (PyPI)

Malicious code in joule-sbx-poc (PyPI)

Malicious code in joule-sbx-poc (PyPI)

Malicious code in dlmm-sdk (PyPI)

Malicious code in dlmm-sdk (PyPI)

Malicious code in kotoraka (PyPI)

Malicious code in kotoraka (PyPI)

Malicious code in neutrl-core (PyPI)

Malicious code in neutrl-core (PyPI)

Malicious code in btcflx (PyPI)

Malicious code in btcflx (PyPI)

Malicious code in neutrl-contracts (PyPI)

Malicious code in neutrl-contracts (PyPI)

Malicious code in bigtime (PyPI)

Malicious code in bigtime (PyPI)

Malicious code in chaintest (PyPI)

Malicious code in chaintest (PyPI)

Malicious code in pytablute (PyPI)

Malicious code in pytablute (PyPI)