jaraco.context Has a Path Traversal Vulnerability

🗓️ 07 Jul 2026 16:03:18Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 23 Views

Zip Slip path traversal in jaraco.context tarball; strip_first_component enables extraction outside target dir.

Reporter	Title	Published	Views	Family All 202
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	6 Apr 202610:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (April 2026 - Part 1 of 2)	1 May 202605:38	–	ibm
IBM Security Bulletins	Security Bulletin: Zip Slip path traversal vulnerability in jaraco.context affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.	1 Sep 202618:47	–	ibm
attackerkb	CVE-2026-23949	20 Jan 202600:36	–	attackerkb
AlpineLinux	CVE-2026-23949	20 Jan 202600:36	–	alpinelinux
BDU FSTEC	The vulnerability of the setuptools project’s packaging simplification library stems from an incorrect limitation on the path to the restricted-access directory. This allows attackers to gain unauthorized access to protected information.	25 Mar 202600:00	–	bdu_fstec
Chainguard	CVE-2026-23949 vulnerabilities	22 Jan 202619:17	–	cgr
Circl	CVE-2026-23949	13 Jan 202602:50	–	circl

Vulners

Node

pypi jaraco-contextRange5.2.0–6.1.0

Source	Link
github	www.github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-23949
github	www.github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9
github	www.github.com/jaraco/jaraco.context
github	www.github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py
github	www.github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py
pypi	www.pypi.org/project/jaraco-context
github	www.github.com/advisories/GHSA-58pv-8j8x-9vj2

07 Jul 2026 17:24Current

6Medium risk

Vulners AI Score6

CVSS 3.18.6

EPSS0.00618

SSVC