streaming-anomaly-detection (>=0.0.7, <=0.0.9) potentially affected by CVE-2026-23528 via distributed (2.21.0)

distributed PYPI version 2.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - streaming-anomaly-detection =0.0.7, =0.0.9 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

esi-acme (>=0.1.0.dev72, <=0.2.0rc2) potentially affected by CVE-2026-23528 via distributed (2.25.0)

distributed PYPI version 2.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - esi-acme =0.1.0.dev72, =0.2.0rc2 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

PYSEC-2026-169

Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting XSS bug in the Dask...

analysis-tools (0.2.1), esi-acme (>=2022.11.0, <=2022.12.0) +2 more potentially affected by CVE-2026-23528 via distributed (2022.10.2)

distributed PYPI version 2022.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - analysis-tools 0.2.1 - esi-acme =2022.11.0, =0.1.0b1, =0.1.0 - simpeg-drivers 0.1.0b1 Source cves: CVE-2026-23528 Source advisory:...

giverny (>=2.2.6, <=2.2.7) potentially affected by CVE-2026-23528 via distributed (2022.11.0)

distributed PYPI version 2022.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - giverny =2.2.6, =2.2.7 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

coiled-runtime (>=0.2.0, <=0.2.1), dask-cuda (>=22.12.0a221208, <=23.2.0a221212) +3 more potentially affected by CVE-2026-23528 via distributed (2022.11.1)

distributed PYPI version 2022.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - coiled-runtime =0.2.0, =22.12.0a221208, =1.0.0, =0.1.7, =0.4.36 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

flowcept (>=0.0.122, <=0.0.133), incremental-trees (0.6.0) potentially affected by CVE-2026-23528 via distributed (2022.12.0)

distributed PYPI version 2022.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - flowcept =0.0.122, =0.0.133 - incremental-trees 0.6.0 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

aces-apps (1.5.4), atflagger (>=0.2.0, <=0.4.6) +36 more potentially affected by CVE-2026-23528 via distributed (2022.12.1)

distributed PYPI version 2022.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - aces-apps 1.5.4 - atflagger =0.2.0, =0.1.0, =1.3.0, =0.0.2.dev0, =0.4.1, =0.0.3, =0.5.0, =2022.12.0, =2022.12.1 and more Source cves:...

aperturedb (>=0.3.9, <=0.4.3), bob-bio-base (8.0.0) +10 more potentially affected by CVE-2026-23528 via distributed (2023.1.0)

distributed PYPI version 2023.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - aperturedb =0.3.9, =0.0.1, =0.0.4 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

dask-cuda (>=23.2.0a230206, <=23.2.1), dask-fly (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-23528 via distributed (2023.1.1)

distributed PYPI version 2023.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-cuda =23.2.0a230206, =0.0.1, =2021.6.4.932, =0.2.0, =0.2.3 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

ax-env (>=0.3.2, <=0.3.3), azureml-automl-dnn-nlp (>=1.49.0, <=1.55.0) +7 more potentially affected by CVE-2026-23528 via distributed (2023.2.0)

distributed PYPI version 2023.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - ax-env =0.3.2, =1.49.0, =1.49.0, =1.49.0, =1.49.0, =1.49.1, =0.17.0, =0.1.3, =0.1.16 - tsinterpret 0.0.11 Source cves: CVE-2026-23528...

arctic-ai (0.1.0), devito (4.8.0) +1 more potentially affected by CVE-2026-23528 via distributed (2023.2.1)

distributed PYPI version 2023.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - arctic-ai 0.1.0 - devito 4.8.0 - nwp-consumer =0.0.1, =0.1.23 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

prefect-dask (0.2.4) potentially affected by CVE-2026-23528 via distributed (2023.3.1)

distributed PYPI version 2023.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - prefect-dask 0.2.4 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

pyoptimus (21.9.0b4), sgm-data (>=0.3.14b0, <=0.3.15b0) +1 more potentially affected by CVE-2026-23528 via distributed (2021.9.0)

distributed PYPI version 2021.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - pyoptimus 21.9.0b4 - sgm-data =0.3.14b0, =0.22.0, =0.23.0 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

dask-cuda (>=21.10.0a210924, <=21.12.0a210927), devito (4.6.0) +1 more potentially affected by CVE-2026-23528 via distributed (2021.9.1)

distributed PYPI version 2021.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-cuda =21.10.0a210924, =0.0.1, =0.0.48 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

cimla (>=0.0.8, <=0.0.18), dask-sql (2021.11.0) +3 more potentially affected by CVE-2026-23528 via distributed (2021.10.0)

distributed PYPI version 2021.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - cimla =0.0.8, =21.11.0b1, =0.1.0, =0.3.7, =0.3.9 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

auto-ts (0.0.63), dask-cuda (>=22.2.0a220125, <=22.4.0a220201) +3 more potentially affected by CVE-2026-23528 via distributed (2022.1.0)

distributed PYPI version 2022.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - auto-ts 0.0.63 - dask-cuda =22.2.0a220125, =22.4.0a220201 - dask-sql 2022.1.0 - sgkit 0.5.0 - sphynxml 2.0.0 Source cves: CVE-2026-2352...

aporia-importer (1.0.6), cg-simulator (>=0.1.0, <=0.1.1) +14 more potentially affected by CVE-2026-23528 via distributed (2021.12.0)

distributed PYPI version 2021.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - aporia-importer 1.0.6 - cg-simulator =0.1.0, =0.1.3, =2.0.0, =0.1.6, =0.2.1, =0.1.4, =0.0.1, =0.2.0, =0.1.0, =0.1.3a0, =22.1.0b1,...

autogluon (>=0.3.2b20211216, <=0.5.3), autogluon-core (>=0.3.2b20211216, <=0.6.3b20230202) +19 more potentially affected by CVE-2026-23528 via distributed (2021.11.2)

distributed PYPI version 2021.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - autogluon =0.3.2b20211216, =0.3.2b20211216, =0.6.3b20230126, =0.4.3b20220616, =0.3.2b20211216, =0.3.2b20211216, =0.5.0b20220623,...

devito (>=4.6.1, <=4.6.2) potentially affected by CVE-2026-23528 via distributed (2022.2.0)

distributed PYPI version 2022.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - devito =4.6.1, =4.6.2 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...