# PyPI Advisories.

Every PyPI Advisory we hold (Python), newest first.

## Records, newest first (an older page)

- [OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation](https://agentprime.io/advisories/GHSA-f5m9-jfrj-jjj7.md)
  `GHSA-f5m9-jfrj-jjj7`, `CVE-2026-116694` · PyPI `opentelemetry-propagator-jaeger`: affected `<1.45.0`, fixed in `1.45.0` · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies](https://agentprime.io/advisories/GHSA-5h93-6whr-6q8j.md)
  `GHSA-5h93-6whr-6q8j`, `CVE-2026-116685` · PyPI `mcp`: affected `>=1.8.0, <1.30.0 || >=2.0.0, <2.2.0`, fixed in `1.30.0`, `2.2.0` · CVSS 5.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure
- [Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas](https://agentprime.io/advisories/GHSA-rwrf-2pqf-9j8j.md)
  `GHSA-rwrf-2pqf-9j8j`, `CVE-2026-116686` · PyPI `mcp`: affected `>=1.10.0, <1.30.0 || >=2.0.0, <2.2.0`, fixed in `1.30.0`, `2.2.0` · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Hydra legacy target blacklist permits unsafe PyYAML loading](https://agentprime.io/advisories/GHSA-wf6j-7hvr-gr93.md)
  `GHSA-wf6j-7hvr-gr93` · PyPI `hydra-core`: affected `>=1.3.6, <1.3.8 || >=1.4.0.dev9, <1.4.0rc3`, fixed in `1.3.8`, `1.4.0rc3` · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-184
- [Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)](https://agentprime.io/advisories/GHSA-8m4g-j4wp-wgcg.md)
  `GHSA-8m4g-j4wp-wgcg`, `CVE-2026-114616`, `PYSEC-2026-4356` · PyPI `authlib`: affected `<1.9.1`, fixed in `1.9.1` · CVSS 7.4 High · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS, Hard-coded credentials
- [Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF](https://agentprime.io/advisories/GHSA-x4rv-c3wx-4cr8.md)
  `GHSA-x4rv-c3wx-4cr8`, `CVE-2026-114620`, `PYSEC-2026-4360` · PyPI `authlib`: affected `>=1.6.0, <1.9.0`, fixed in `1.9.0` · CVSS 5.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Authlib: ID token can disable its own nonce validation via the nonce_supported claim](https://agentprime.io/advisories/GHSA-c5mf-xmp2-59rc.md)
  `GHSA-c5mf-xmp2-59rc`, `CVE-2026-114617`, `PYSEC-2026-4357` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 4.2 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass, CWE-807
- [Authlib: Default JWT bearer grant accepts assertions for the wrong audience](https://agentprime.io/advisories/GHSA-fch4-3c6x-j4gc.md)
  `GHSA-fch4-3c6x-j4gc`, `CVE-2026-114618`, `PYSEC-2026-4358` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 6.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens](https://agentprime.io/advisories/GHSA-q686-2qmg-hqc7.md)
  `GHSA-q686-2qmg-hqc7`, `CVE-2026-114619`, `PYSEC-2026-4359` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 4.6 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys](https://agentprime.io/advisories/GHSA-7vr2-2fgp-9w7p.md)
  `GHSA-7vr2-2fgp-9w7p`, `CVE-2026-114615`, `PYSEC-2026-4355` · PyPI `authlib`: affected `>=1.3.1, <1.9.0`, fixed in `1.9.0` · CVSS 7.4 High · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS, CWE-184
- [Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts](https://agentprime.io/advisories/GHSA-jj7h-c3hg-m23x.md)
  `GHSA-jj7h-c3hg-m23x`, `CVE-2026-114614`, `PYSEC-2026-4354` · PyPI `authlib`: affected `<1.8.0`, fixed in `1.8.0` · CVSS 2.6 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS, Open redirect, CWE-693
- [dnspython dns.name.from_wire_parser() excessive CPU use](https://agentprime.io/advisories/GHSA-45c3-73f7-pv4m.md)
  `GHSA-45c3-73f7-pv4m`, `CVE-2026-114605` · PyPI `dnspython`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Datadog dd-trace-py: ReDoS in URL query string obfuscation](https://agentprime.io/advisories/GHSA-3633-r77q-h3v3.md)
  `GHSA-3633-r77q-h3v3`, `CVE-2026-116588` · PyPI `ddtrace`: affected `>=1.5.0, <3.19.9 || >=4.0.0, <4.15.6`, fixed in `3.19.9`, `4.15.6` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Datadog dd-trace-py: IAST instrumentation can lead to application DOS](https://agentprime.io/advisories/GHSA-p3m5-h5v9-vqj6.md)
  `GHSA-p3m5-h5v9-vqj6`, `CVE-2026-116589` · PyPI `ddtrace`: affected `>=3.13.0, <4.15.5`, fixed in `4.15.5` · CVSS 8.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-248
- [MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element](https://agentprime.io/advisories/GHSA-98qm-wvgf-w4cf.md)
  `GHSA-98qm-wvgf-w4cf`, `CVE-2026-106435` · PyPI `pymongo`: affected `>=3.9.0, <4.18.3`, fixed in `4.18.3` · CVSS 5.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution](https://agentprime.io/advisories/GHSA-h3rc-6mm3-gc2m.md)
  `GHSA-h3rc-6mm3-gc2m`, `CVE-2026-114053` · PyPI `vllm`: affected `>=0.7.3, <0.31.0`, fixed in `0.31.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Code injection, CWE-829
- [Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage](https://agentprime.io/advisories/GHSA-3w55-933p-8pv5.md)
  `GHSA-3w55-933p-8pv5` · PyPI `strands-agents`: affected `<1.48.0`, fixed in `1.48.0` · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal
- [Strands Agents: Default FileSessionManager storage is world-readable on shared systems](https://agentprime.io/advisories/GHSA-763v-5pjm-fx36.md)
  `GHSA-763v-5pjm-fx36` · PyPI `strands-agents`: affected `<1.48.0`, fixed in `1.48.0` · CVSS 4.0, no score published · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (\_escape()) - full graph wipe from ingested-document content](https://agentprime.io/advisories/GHSA-vqrg-773h-4wxc.md)
  `GHSA-vqrg-773h-4wxc`, `CVE-2026-114510` · PyPI `flexible-graphrag`: affected `>=0.6.0, <0.8.2`, fixed in `0.8.2` · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, CWE-116
- [LiteLLM: internal_user_viewer arbitrary local file read via \`vertex_ai_credentials\`](https://agentprime.io/advisories/GHSA-g5ff-637f-6q2m.md)
  `GHSA-g5ff-637f-6q2m` · PyPI `litellm`: affected `<1.95.0`, fixed in `1.95.0` · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal, CWE-20
- [LiteLLM vulnerable to reflected XSS in /sso/debug/callback](https://agentprime.io/advisories/GHSA-hhww-mrg2-969h.md)
  `GHSA-hhww-mrg2-969h` · PyPI `litellm`: affected `>=1.65.5, <1.85.0`, fixed in `1.85.0` · CVSS 6.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GitPython: arbitrary file read via attacker-controlled branch name in \`Head.checkout()\` (incomplete fix of CVE-2026-78679)](https://agentprime.io/advisories/GHSA-23mf-xhv8-69c2.md)
  `GHSA-23mf-xhv8-69c2`, `CVE-2026-110859` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal, Command injection, Information disclosure
- [GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree](https://agentprime.io/advisories/GHSA-gq48-pqfc-9p58.md)
  `GHSA-gq48-pqfc-9p58`, `CVE-2026-110860` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal
- [GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution](https://agentprime.io/advisories/GHSA-f9j4-qggq-h239.md)
  `GHSA-f9j4-qggq-h239`, `CVE-2026-110858` · PyPI `gitpython`: affected `>=3.1.30, <3.2.0`, fixed in `3.2.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Command injection
- [GitPython command wrappers omit unsafe protocol and option checks](https://agentprime.io/advisories/GHSA-w8jc-g24h-crhw.md)
  `GHSA-w8jc-g24h-crhw`, `CVE-2026-110857` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 7.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-1287
- [GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name](https://agentprime.io/advisories/GHSA-fx3j-rwgx-fr94.md)
  `GHSA-fx3j-rwgx-fr94`, `CVE-2026-110855` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure
- [GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines](https://agentprime.io/advisories/GHSA-m64x-33q8-m5h7.md)
  `GHSA-m64x-33q8-m5h7`, `CVE-2026-110856` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key](https://agentprime.io/advisories/GHSA-7hp6-4w63-5g45.md)
  `GHSA-7hp6-4w63-5g45`, `CVE-2026-114612` · PyPI `litellm`: affected `>=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2`, fixed in `1.100.4`, `1.101.3`, `1.102.2`, `1.103.1`, `1.104.0rc2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation, CWE-345, CWE-441
- [MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure](https://agentprime.io/advisories/GHSA-j586-36cw-2gc2.md)
  `GHSA-j586-36cw-2gc2`, `CVE-2026-114613` · PyPI `msgpack`: affected `<1.2.3`, fixed in `1.2.3` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service, Memory corruption
- [NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment](https://agentprime.io/advisories/GHSA-j456-xh4h-cpf2.md)
  `GHSA-j456-xh4h-cpf2`, `CVE-2026-109956` · PyPI `nltk`: affected `<3.10.4`, fixed in `3.10.4` · CVSS 8.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal
- [Authlib: empty signatures validation in JWS JSON deserialization](https://agentprime.io/advisories/GHSA-6v38-4h7w-rj9h.md)
  `GHSA-6v38-4h7w-rj9h`, `CVE-2026-96760` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS, CWE-20, CWE-358, CWE-670
- [Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME](https://agentprime.io/advisories/GHSA-22qq-2fwx-7p67.md)
  `GHSA-22qq-2fwx-7p67`, `CVE-2026-114608` · PyPI `pylint`: affected `<4.0.9`, fixed in `4.0.9` · CVSS 5.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Insecure deserialization
- [vllm p2p never connected zmq_exhaustion](https://agentprime.io/advisories/GHSA-frvg-qw88-hww9.md)
  `GHSA-frvg-qw88-hww9`, `CVE-2026-94624`, `PYSEC-2026-4006` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs](https://agentprime.io/advisories/GHSA-qr6x-7v33-6qmg.md)
  `GHSA-qr6x-7v33-6qmg`, `CVE-2026-115924` · PyPI `rembg`: affected `<2.0.82`, fixed in `2.0.82` · CVSS 8.6 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal
- [Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation](https://agentprime.io/advisories/GHSA-jj36-9pvh-vj5r.md)
  `GHSA-jj36-9pvh-vj5r`, `CVE-2026-83813` · PyPI `twisted`: affected `<26.10.0rc1`, fixed in `26.10.0rc1` · CVSS 3.1 Low · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-346
- [fpdf2: Exponential SVG '\<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'](https://agentprime.io/advisories/GHSA-wqw6-wpr3-45rh.md)
  `GHSA-wqw6-wpr3-45rh`, `CVE-2026-114610` · PyPI `fpdf2`: affected `>=2.5.0, <2.8.8`, fixed in `2.8.8` · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content](https://agentprime.io/advisories/GHSA-rw7v-4hrq-x6r9.md)
  `GHSA-rw7v-4hrq-x6r9`, `CVE-2026-114609` · PyPI `fpdf2`: affected `<2.8.8`, fixed in `2.8.8` · CVSS 5.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow](https://agentprime.io/advisories/GHSA-3jp2-3mrg-2vxc.md)
  `GHSA-3jp2-3mrg-2vxc`, `CVE-2026-49272` · PyPI `oauthlib`: affected `>=3.3.0, <4.0.1`, fixed in `4.0.1` · CVSS 8.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)](https://agentprime.io/advisories/GHSA-6hp3-vr39-rqw8.md)
  `GHSA-6hp3-vr39-rqw8`, `CVE-2026-48705` · PyPI `monai`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-682
- [Ajenti has potential Remote Code Execution](https://agentprime.io/advisories/GHSA-vcw3-r3fx-j444.md)
  `GHSA-vcw3-r3fx-j444`, `CVE-2026-27975` · PyPI `aj`: affected `<2.2.13`, fixed in `2.2.13` · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inferenc...](https://agentprime.io/advisories/GHSA-34qw-q2h2-jp3m.md)
  `GHSA-34qw-q2h2-jp3m`, `CVE-2026-116178`, `PYSEC-2026-4353` · PyPI `vllm`: affected `>=0.20.0, <0.30.0`, fixed in `0.30.0` · CVSS 8.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-20
- [vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Im...](https://agentprime.io/advisories/GHSA-mm38-5g96-7j6x.md)
  `GHSA-mm38-5g96-7j6x`, `CVE-2026-116177`, `PYSEC-2026-4352` · PyPI `vllm`: affected `>=0.10.2, <0.25.0`, fixed in `0.25.0` · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Denial of service
- [vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. At...](https://agentprime.io/advisories/GHSA-vfp2-c8pq-v6h6.md)
  `GHSA-vfp2-c8pq-v6h6`, `CVE-2026-116176`, `PYSEC-2026-4351` · PyPI `vllm`: affected `>=0.9.2, <0.24.0`, fixed in `0.24.0` · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attac...](https://agentprime.io/advisories/GHSA-6pgw-f3pv-4h8q.md)
  `GHSA-6pgw-f3pv-4h8q`, `CVE-2026-116173`, `PYSEC-2026-4350` · PyPI `vllm`: affected `>=0.22.0, <0.24.0`, fixed in `0.24.0` · CVSS 8.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-20
- [filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-\* link directory name](https://agentprime.io/advisories/GHSA-jqc4-5cvw-7w85.md)
  `GHSA-jqc4-5cvw-7w85`, `CVE-2026-112937` · PyPI `filelock`: affected `>=4.1.0, <4.2.1`, fixed in `4.2.1` · CVSS 6.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Race condition
- [filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database](https://agentprime.io/advisories/GHSA-9vhv-jxww-xfm5.md)
  `GHSA-9vhv-jxww-xfm5`, `CVE-2026-112913` · PyPI `filelock`: affected `>=3.20.4, <4.2.1`, fixed in `4.2.1` · CVSS 3.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Race condition
- [filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break](https://agentprime.io/advisories/GHSA-567q-5qvw-pf92.md)
  `GHSA-567q-5qvw-pf92`, `CVE-2026-112907` · PyPI `filelock`: affected `>=3.22.0, <4.2.1`, fixed in `4.2.1` · CVSS 2.5 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-667
- [virtualenv: Temporary app-data can leave dangling seed package links](https://agentprime.io/advisories/GHSA-4f8h-vr72-p32c.md)
  `GHSA-4f8h-vr72-p32c`, `BIT-virtualenv-2026-113713`, `CVE-2026-113713` · PyPI `virtualenv`: affected `>=21.14.8, <21.14.10`, fixed in `21.14.10` · CVSS 4.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-377
- [virtualenv: Pip seeding with download omits wheel digest verification](https://agentprime.io/advisories/GHSA-cx28-75q4-x26q.md)
  `GHSA-cx28-75q4-x26q`, `BIT-virtualenv-2026-113717`, `CVE-2026-113717` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 2.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-494
- [virtualenv: Downloaded wheel selection and caching precede verification](https://agentprime.io/advisories/GHSA-494p-63j8-28p3.md)
  `GHSA-494p-63j8-28p3`, `BIT-virtualenv-2026-113714`, `CVE-2026-113714` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 2.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-354
- [virtualenv: Xonsh activation literals depend on the script decoding codec](https://agentprime.io/advisories/GHSA-394h-qwmc-48pf.md)
  `GHSA-394h-qwmc-48pf`, `BIT-virtualenv-2026-113718`, `CVE-2026-113718` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Code injection
- [virtualenv: Seeded files retain permissions from an older cache](https://agentprime.io/advisories/GHSA-fc2g-4w5p-6whm.md)
  `GHSA-fc2g-4w5p-6whm`, `BIT-virtualenv-2026-113720`, `CVE-2026-113720` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 4.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [virtualenv: Bash prompt values can change meaning under older compatibility modes](https://agentprime.io/advisories/GHSA-6w3r-xr62-4xcp.md)
  `GHSA-6w3r-xr62-4xcp`, `BIT-virtualenv-2026-113723`, `CVE-2026-113723` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Command injection
- [virtualenv: Venv configuration readback can reinterpret path boundaries](https://agentprime.io/advisories/GHSA-qmx5-4p3x-wvqf.md)
  `GHSA-qmx5-4p3x-wvqf`, `BIT-virtualenv-2026-113715`, `CVE-2026-113715` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 2.0 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Other injection
- [virtualenv: Seed replacement does not contain metadata deletion paths](https://agentprime.io/advisories/GHSA-hhxq-47xx-j5xx.md)
  `GHSA-hhxq-47xx-j5xx`, `BIT-virtualenv-2026-113719`, `CVE-2026-113719` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 4.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints](https://agentprime.io/advisories/GHSA-2wqp-q3c6-ccj5.md)
  `GHSA-2wqp-q3c6-ccj5`, `BIT-mlflow-2026-115886`, `CVE-2026-115886` · PyPI `mlflow`: affected `>=3.12.0rc0, <3.17.0`, fixed in `3.17.0` · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Code injection, Server-side request forgery (SSRF)
- [LangGraph: Namespace labels containing \`.\` reach other namespaces in Postgres and SQLite stores](https://agentprime.io/advisories/GHSA-6hmw-9432-67qq.md)
  `GHSA-6hmw-9432-67qq`, `CVE-2026-115883` · PyPI `langgraph-checkpoint-postgres` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 6.0 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control, CWE-20
- [filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse](https://agentprime.io/advisories/GHSA-2g95-wg33-c5x2.md)
  `GHSA-2g95-wg33-c5x2`, `CVE-2026-112906` · PyPI `filelock`: affected `>=4.1.0, <4.2.1`, fixed in `4.2.1` · CVSS 4.7 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-694
- [filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory](https://agentprime.io/advisories/GHSA-crv4-6mhj-j5jh.md)
  `GHSA-crv4-6mhj-j5jh`, `CVE-2026-112914` · PyPI `filelock`: affected `>=4.1.0, <4.2.1`, fixed in `4.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, CWE-363
- [filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files](https://agentprime.io/advisories/GHSA-v4x8-3wr5-3wq8.md)
  `GHSA-v4x8-3wr5-3wq8`, `CVE-2026-112940` · PyPI `filelock`: affected `>=3.20.4, <4.2.1`, fixed in `4.2.1` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, CWE-363

Newest: <https://agentprime.io/advisories/ecosystem/pypi.md>
Older: <https://agentprime.io/advisories/ecosystem/pypi.md?cursor=WyIyMDI2LTEwLTIzVDIxOjU5OjA4LjAwMDAwMFoiLCJHSFNBLXY0eDgtM3dyNS0zd3E4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=PyPI&cursor=WyIyMDI2LTEwLTI3VDIxOjA2OjU5LjAwMDAwMFoiLCJHSFNBLXc0ZmgtcXZ2OS0zdjIzIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/pypi/?cursor=WyIyMDI2LTEwLTI3VDIxOjA2OjU5LjAwMDAwMFoiLCJHSFNBLXc0ZmgtcXZ2OS0zdjIzIl0>. Everything for agents: <https://agentprime.io/llms.txt>.