faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48817 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

fastapi (0.77.0), goe-framework (>=1.0.6.dev0, <=1.1.0) +1 more potentially affected by CVE-2026-48817 via starlette (0.19.0)

starlette PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.77.0 - goe-framework =1.0.6.dev0, =0.2.6, =0.2.8 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

fastapi (0.1.18) potentially affected by CVE-2026-48817 via starlette (0.9.10)

starlette PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.1.18 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

accidental-vulnerability (>=2.0.4, <=2.0.5), fastapi (>=0.1.19, <=0.5.1) potentially affected by CVE-2026-48817 via starlette (0.10.1)

starlette PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - accidental-vulnerability =2.0.4, =0.1.19, =0.5.1 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48817 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48817 Source advisor...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-48817 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-22...

async-easy-utils (>=0.0.1, <=0.1.3), busylight-for-humans (>=0.4.0, <=0.4.3) +22 more potentially affected by CVE-2026-48818 via starlette (0.13.4)

starlette PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - async-easy-utils =0.0.1, =0.4.0, =0.1.0, =0.57.0, =2.0.0, =1.0.1, =1.0.0b50, =0.1.0, =0.1.0, =0.1.16, =0.0.1.dev1, =2.0.0a1, =0.1.5, =0.1.7 a...

agent-os-py (>=0.0.1, <=0.1.1), agl-ocr-reader (1.1.1) +13 more potentially affected by CVE-2026-48818 via starlette (0.28.0)

starlette PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agent-os-py =0.0.1, =1.0.22, =0.4.4, =2023.8.0b1, =6.1.8, =0.1.25, =0.1.0a3, =0.1.0a11 Source cves: CVE-2026-48818 Source advisory:...

fastapi (0.77.0), goe-framework (>=1.0.6.dev0, <=1.1.0) +1 more potentially affected by CVE-2026-48818 via starlette (0.19.0)

starlette PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.77.0 - goe-framework =1.0.6.dev0, =0.2.6, =0.2.8 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

beeai-cli (>=0.3.0rc4, <=0.3.4rc1), catweazle (>=1.0.0, <=1.0.2) +16 more potentially affected by CVE-2026-48818 via starlette (0.47.2)

starlette PYPI version 0.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - beeai-cli =0.3.0rc4, =1.0.0, =2.6.1, =1.3.0, =2.37.0, =1.2.5, =1.0.0, =0.12.4, =0.0.1, =1.0.0, =0.1.0, =0.1.34 and more Source cves:...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-48818 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

fastapi (0.1.18) potentially affected by CVE-2026-48818 via starlette (0.9.10)

starlette PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.1.18 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48818 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

bali-core (>=3.1.0, <=3.2.1), datapipe-app (0.1.7) +7 more potentially affected by CVE-2026-48818 via starlette (0.15.0)

starlette PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bali-core =3.1.0, =0.9.0, =1.0.0, =0.1.3, =0.1.7 - yiri-mirai 0.1.3 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48818 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48818 Source advisor...

fastapi (>=0.6.0, <=0.22.0) potentially affected by CVE-2026-48818 via starlette (0.11.1)

starlette PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi =0.6.0, =0.22.0 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

PYSEC-2026-2281

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s...

amarillo (>=0.0.15a3, <=0.0.16a1), ant31box (0.1.0) +48 more potentially affected by CVE-2026-48818 via starlette (0.35.1)

starlette PYPI version 0.35.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - amarillo =0.0.15a3, =0.10.163, =0.3.2, =1.0.0, =0.0.1, =0.4.8, =0.4.8, =0.0.9, =1.0.0, =0.109.0, =2.3.0, =2.3.1 and more Source cves:...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +254 more potentially affected by CVE-2026-48818 via starlette (0.14.2)

starlette PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =3.0.0, =3.0.0a1, =0.1.5, =0.1.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-48818...

CVE-2026-48818

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s...