subaligner (>=0.0.6rc1, <=0.3.6) potentially affected by CVE-2026-23528 via distributed (1.13.0)

distributed PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - subaligner =0.0.6rc1, =0.3.6 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

codeentropy (>=1.0.0, <=2.0.0), cugraph-cu12 (25.8.0) +16 more potentially affected by CVE-2026-23528 via distributed (2025.7.0)

distributed PYPI version 2025.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - codeentropy =1.0.0, =0.0.4, =1.0.0, =1.9.5, =0.1.0, =0.5.1 and more Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ...

gdptools (0.1.0.post2), gdptools-pygeoapi-plugin (>=0.0.9.dev0, <=0.0.11.dev0) +1 more potentially affected by CVE-2026-23528 via distributed (2023.8.1)

distributed PYPI version 2023.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - gdptools 0.1.0.post2 - gdptools-pygeoapi-plugin =0.0.9.dev0, =0.4.1, =1.0.4 Source cves: CVE-2026-23528 Source advisory:...

dagster-dask (>=0.11.15rc0, <=0.12.14rc0), edx-prefectutils (>=2.0.1, <=2.3.8) +9 more potentially affected by CVE-2026-23528 via distributed (2023.3.0)

distributed PYPI version 2023.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dagster-dask =0.11.15rc0, =2.0.1, =0.0.3.dev0, =0.3.3, =0.2.2, =0.0.1, =0.9.0.9000, =0.14.20, =0.4.0b0, =0.5.0b0 - sundial-framework...

leap-ec (0.8.2), neofox (>=1.2.1, <=1.2.3) +6 more potentially affected by CVE-2026-23528 via distributed (2024.6.2)

distributed PYPI version 2024.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - leap-ec 0.8.2 - neofox =1.2.1, =0.10.1, =0.5.27, =0.2.0b3, =0.1.0b4, =0.2.0b1, =0.0.3, =0.1.0 Source cves: CVE-2026-23528 Source...

dask-janelia (0.1.2), fibsem-tools (>=0.1.3, <=0.1.4) potentially affected by CVE-2026-23528 via distributed (2020.12.0)

distributed PYPI version 2020.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-janelia 0.1.2 - fibsem-tools =0.1.3, =0.1.4 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

ax-env (>=0.2.6, <=0.3.1), dask-cuda (>=22.6.0a220528, <=22.8.0a220616) +5 more potentially affected by CVE-2026-23528 via distributed (2022.5.2)

distributed PYPI version 2022.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - ax-env =0.2.6, =22.6.0a220528, =0.1.8, =2022.7.0, =0.0.7, =0.0.15 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

coiled-runtime (>=0.2.0, <=0.2.1), dask-cuda (>=22.12.0a221208, <=23.2.0a221212) +3 more potentially affected by CVE-2026-23528 via distributed (2022.11.1)

distributed PYPI version 2022.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - coiled-runtime =0.2.0, =22.12.0a221208, =1.0.0, =0.1.7, =0.4.36 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

anoexpress (0.3.0), echofish-aws-create-empty-zarr-store-lambda (>=1.0.0.dev20230524182219, <=1.0.0.dev20230705184439) +8 more potentially affected by CVE-2026-23528 via distributed (2024.8.1)

distributed PYPI version 2024.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - anoexpress 0.3.0 - echofish-aws-create-empty-zarr-store-lambda =1.0.0.dev20230524182219, =1.0.0.dev20230906215656,...

pybnf (>=0.3.1, <=1.1.6) potentially affected by CVE-2026-23528 via distributed (1.24.0)

distributed PYPI version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - pybnf =0.3.1, =1.1.6 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

analysis-tools (0.2.1), esi-acme (>=2022.11.0, <=2022.12.0) +2 more potentially affected by CVE-2026-23528 via distributed (2022.10.2)

distributed PYPI version 2022.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - analysis-tools 0.2.1 - esi-acme =2022.11.0, =0.1.0b1, =0.1.0 - simpeg-drivers 0.1.0b1 Source cves: CVE-2026-23528 Source advisory:...

cellphonedbu (>=1.1.1.6, <=1.1.1.7), dagster-dask (>=0.5.0rc4, <=0.6.4) +2 more potentially affected by CVE-2026-23528 via distributed (1.28.1)

distributed PYPI version 1.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - cellphonedbu =1.1.1.6, =0.5.0rc4, =0.5.0, =0.5.5 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

quartical (0.2.3) potentially affected by CVE-2026-23528 via distributed (2024.4.2)

distributed PYPI version 2024.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - quartical 0.2.3 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

calitp-data-analysis (>=2026.1.30, <=2026.3.5), egamma-tnp (0.6.0) +5 more potentially affected by CVE-2026-23528 via distributed (2025.3.1)

distributed PYPI version 2025.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - calitp-data-analysis =2026.1.30, =0.2.1a3, =0.2.0a1, =0.3.0a4, =0.5.2rc1 Source cves: CVE-2026-23528 Source advisory:...

GHSA-C336-7962-WFJ2 Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard

Impact When Jupyter Lab, jupyter-server-proxy and Dask distributed are all run together it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting XSS bug in the Dask dashboard. It is possible for attackers to craft a phishing URL that assumes...

pp-role-mining (>=0.0.1, <=0.0.6) potentially affected by CVE-2026-23528 via distributed (1.21.8)

distributed PYPI version 1.21.8 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - pp-role-mining =0.0.1, =0.0.6 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

dask-cuda (>=21.6.0a210607, <=21.8.0a210608), mosartwmpy (>=0.0.5, <=0.0.7) +1 more potentially affected by CVE-2026-23528 via distributed (2021.5.1)

distributed PYPI version 2021.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-cuda =21.6.0a210607, =0.0.5, =1.2.1, =1.4.2 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

dask-sql (>=2022.4.0, <=2022.4.1) potentially affected by CVE-2026-23528 via distributed (2022.4.0)

distributed PYPI version 2022.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-sql =2022.4.0, =2022.4.1 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...

dask-cuda (>=22.6.0a220409, <=22.8.0a220526), dask-gateway (2022.4.0) +1 more potentially affected by CVE-2026-23528 via distributed (2023.10.1)

distributed PYPI version 2023.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-cuda =22.6.0a220409, =22.8.0a220526 - dask-gateway 2022.4.0 - sm-grams 2.1.7 Source cves: CVE-2026-23528 Source advisory:...

devito (>=4.6.1, <=4.6.2) potentially affected by CVE-2026-23528 via distributed (2022.2.0)

distributed PYPI version 2022.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - devito =4.6.1, =4.6.2 Source cves: CVE-2026-23528 Source advisory: OSV:GHSA-C336-7962-WFJ2...