PyPI Advisories.

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

• Memory corruption

<13.0.0 · fixed in 13.0.0

Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

• Memory corruption
• CWE-226

>=11.2.1, <13.0.0 · fixed in 13.0.0

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

• Path traversal

>=38.2.2, <84.1.0 · fixed in 84.1.0

FastMCP: Post-transform component authorization is skipped on direct calls

• Broken access control

>=3.0.0, <3.4.10 || >=4.0.0, <4.1.2 · fixed in 3.4.10, 4.1.2

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

• Authentication bypass
• Hard-coded credentials

>=4.0.0a1, <4.1.2 · fixed in 4.1.2

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

• Denial of service

>=0.7.3, <0.31.0 · fixed in 0.31.0

pypdf: Possible long runtimes for repeated references to the same missing object

• Denial of service

<6.21.2 · fixed in 6.21.2

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

• Denial of service

<6.21.2 · fixed in 6.21.2

pypdf: Possible long runtimes for large xref table header limits

• Denial of service

<6.21.2 · fixed in 6.21.2

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

• CWE-488

<1.5.0 · fixed in 1.5.0

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

• Command injection

>=21.14.9, <21.14.13 · fixed in 21.14.13

Mistune: Path Traversal and XSS in Include directive

• Path traversal

<3.3.0 · fixed in 3.3.0

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

• Denial of service

<26.10.0rc1 · fixed in 26.10.0rc1

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

• HTTP request smuggling

<26.10.0rc1 · fixed in 26.10.0rc1

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

• CWE-345

<0.31.0 · fixed in 0.31.0

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

• Path traversal

* · no fixed version yet

virtualenv: Generated files can follow existing destination links

• Path traversal

<21.14.9 · fixed in 21.14.9

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

• Memory corruption
• CWE-1395

>=11.1.0, <13.0.0 · fixed in 13.0.0

pypdf: Possible long runtimes/large memory usage when retrieving form fields

• Denial of service

<6.21.0 · fixed in 6.21.0

pypdf: Possible large memory usage when parsing arrays and dictionaries

• Denial of service

<6.21.0 · fixed in 6.21.0

pypdf: Possible large memory usage when parsing content streams

• Denial of service

<6.21.0 · fixed in 6.21.0

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

• CWE-696

<3.2.1 · fixed in 3.2.1

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

• Denial of service

>=3.2.3, <3.2.12 || >=3.3.0a3, <3.3.0rc1 · fixed in 3.2.12, 3.3.0rc1

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

• Denial of service

>=3.0.0, <3.2.12 || >=3.3.0a1, <3.3.0rc1 · fixed in 3.2.12, 3.3.0rc1

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

• Path traversal

>=5.4.0, <7.17.2 · fixed in 7.17.2

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

• Denial of service

<1.45.1 · fixed in 1.45.1

Black: GitHub Action installs unvalidated required-version from pyproject.toml

• CWE-829

<26.10.1 · fixed in 26.10.1

Django REST framework: TokenProxy.delete() reports success and revokes nothing

• Authentication bypass
• CWE-390

>=3.12.0, <3.18.2 · fixed in 3.18.2

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

• Denial of service

<3.18.2 · fixed in 3.18.2

Django REST framework: JSONParser applies an attacker-named codec to the request stream

• Denial of service
• CWE-409

>=3.6.4, <3.18.2 · fixed in 3.18.2

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

• Memory corruption

>=9.4.0, <13.0.0 · fixed in 13.0.0

Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

• Memory corruption

<13.0.0 · fixed in 13.0.0

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

• Denial of service

>=11.0.0, <13.0.0 · fixed in 13.0.0

Pillow: TarIO negative size field causes infinite CPU-spin loop

• Denial of service

<13.0.0 · fixed in 13.0.0

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

• Memory corruption

<13.0.0 · fixed in 13.0.0

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Pillow multi-frame loaders can reuse stale native image storage after mode transitions

• Memory corruption

>=11.0.0, <13.0.0 · fixed in 13.0.0

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

• Denial of service

>=9.1.0, <13.0.0 · fixed in 13.0.0

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

• Denial of service
• CWE-409

<13.0.0 · fixed in 13.0.0

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

• Denial of service
• CWE-409

<13.0.0 · fixed in 13.0.0

PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

• Weak cryptography or TLS

<2.14.0 · fixed in 2.14.0

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

• Broken access control

>=2.0.0, <2.6.0 · fixed in 2.6.0

mem0ai Databricks vector store vulnerable to SQL injection

• SQL injection

>=0.1.117, <1.0.8 · fixed in 1.0.8

virtualenv: Builtin creation follows linked environment directories

• Path traversal

<21.14.9 · fixed in 21.14.9

virtualenv: Deletion recovery can change a symlink target's mode

• Path traversal

<21.14.9 · fixed in 21.14.9

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

• Command injection

<21.14.9 · fixed in 21.14.9

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

• CWE-686

<13.0.0 · fixed in 13.0.0

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

• Memory corruption

>=2.0.0, <13.0.0 · fixed in 13.0.0

Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

• Memory corruption

>=11.3.0, <13.0.0 · fixed in 13.0.0

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Pillow: APNG background disposal allocates full canvas before decompression bomb check

• Denial of service

>=8.1.0, <13.0.0 · fixed in 13.0.0

Pillow: MSP RLE decoder expands a tiny file into unbounded memory

• CWE-409

>=4.1.0, <13.0.0 · fixed in 13.0.0

Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

• Denial of service

<13.0.0 · fixed in 13.0.0

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

• Memory corruption

>=9.1.0, <13.0.0 · fixed in 13.0.0

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

• Denial of service

>=5.4.0, <13.0.0 · fixed in 13.0.0