jaraco.context Has a Path Traversal Vulnerability

🗓️ 13 Jan 2026 21:48:17Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 255 Views

Zip Slip in jaraco.context tarball via strip_first_component filter may extract outside target dir.

Reporter	Title	Published	Views	Family All 55
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	6 Apr 202610:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (April 2026 - Part 1 of 2)	1 May 202605:38	–	ibm
IBM Security Bulletins	Security Bulletin: Zip Slip path traversal vulnerability in jaraco.context affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:24	–	ibm
ATTACKERKB	CVE-2026-23949	20 Jan 202600:36	–	attackerkb
AlpineLinux	CVE-2026-23949	20 Jan 202600:36	–	alpinelinux
BDU FSTEC	The vulnerability of the setuptools project’s packaging simplification library stems from an incorrect limitation on the path to the restricted-access directory. This allows attackers to gain unauthorized access to protected information.	25 Mar 202600:00	–	bdu_fstec
Chainguard	CVE-2026-23949 vulnerabilities	22 Jan 202619:17	–	cgr
Circl	CVE-2026-23949	13 Jan 202602:50	–	circl
CNNVD	jaraco.context path traversal vulnerability	20 Jan 202600:00	–	cnnvd

Vulners

Node

jaraco jaraco.contextRange5.2.0–6.1.0pip

Source	Link
github	www.github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2
github	www.github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-23949
github	www.github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py
github	www.github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py
github	www.github.com/advisories/GHSA-58pv-8j8x-9vj2

22 Jan 2026 22:25Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.6

EPSS0.00527

SSVC