EUVD-2026-37773

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s...

CVE-2026-53869: Missing Authentication for Critical Function

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling...

CVE-2026-48817: Use of Externally-Controlled Input to Select Classes or Code

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an...

definitive-openassistants (>=0.0.1, <=0.0.7), definitive-openassistants-fastapi (>=0.0.1, <=0.0.3) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.346)

langchain PYPI version 0.0.346 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - definitive-openassistants =0.0.1, =0.0.1, =1.7.0, =1.7.0, =2.7.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

accidental-vulnerability (>=2.0.4, <=2.0.5), fastapi (>=0.1.19, <=0.5.1) potentially affected by CVE-2026-54282 via starlette (0.10.1)

starlette PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - accidental-vulnerability =2.0.4, =0.1.19, =0.5.1 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-54282 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-54282 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-54282 Source advisor...

fastapi (0.77.0), goe-framework (>=1.0.6.dev0, <=1.1.0) +1 more potentially affected by CVE-2026-54282 via starlette (0.19.0)

starlette PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.77.0 - goe-framework =1.0.6.dev0, =0.2.6, =0.2.8 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-54282 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-54282 Source advisory:...

async-easy-utils (>=0.0.1, <=0.1.3), busylight-for-humans (>=0.4.0, <=0.4.3) +22 more potentially affected by CVE-2026-54282 via starlette (0.13.4)

starlette PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - async-easy-utils =0.0.1, =0.4.0, =0.1.0, =0.57.0, =2.0.0, =1.0.1, =1.0.0b50, =0.1.0, =0.1.0, =0.1.16, =0.0.1.dev1, =2.0.0a1, =0.1.5, =0.1.7 a...

bali-core (>=3.1.0, <=3.2.1), datapipe-app (0.1.7) +7 more potentially affected by CVE-2026-54282 via starlette (0.15.0)

starlette PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bali-core =3.1.0, =0.9.0, =1.0.0, =0.1.3, =0.1.7 - yiri-mirai 0.1.3 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

fastapi (>=0.6.0, <=0.22.0) potentially affected by CVE-2026-54282 via starlette (0.11.1)

starlette PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi =0.6.0, =0.22.0 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

beeai-cli (>=0.3.0rc4, <=0.3.4rc1), catweazle (>=1.0.0, <=1.0.2) +16 more potentially affected by CVE-2026-54282 via starlette (0.47.2)

starlette PYPI version 0.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - beeai-cli =0.3.0rc4, =1.0.0, =2.6.1, =1.3.0, =2.37.0, =1.2.5, =1.0.0, =0.12.4, =0.0.1, =1.0.0, =0.1.0, =0.1.34 and more Source cves:...

fastapi (0.1.18) potentially affected by CVE-2026-54282 via starlette (0.9.10)

starlette PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.1.18 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-54282 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

aa-rag (>=0.4.2, <=0.4.3), ab-auth-client-service (>=0.1.3, <=0.3.5) +896 more potentially affected by CVE-2026-54282 via starlette (0.46.2)

starlette PYPI version 0.46.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aa-rag =0.4.2, =0.1.3, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1, =0.1.1, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and mor...

GHSA-6JV3-5F52-599M python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

Summary QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse since the CVE-2021-23336 fix treat only & as a separator. This creates a parser differential: the same bytes...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48818 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48818 Source advisor...

axdocsystem (>=0.1.2, <=0.1.52), columbus (>=0.1.0, <=0.1.9) +10 more potentially affected by CVE-2026-48818 via starlette (0.24.0)

starlette PYPI version 0.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - axdocsystem =0.1.2, =0.1.0, =2.0.7, =0.0.31, =0.1.2, =1.0.1rc1, =0.2.4, =5.3.0b1, =5.3.0b2 Source cves: CVE-2026-48818 Source advisory:...

acte (>=0.0.3, <=0.0.15), ellar (>=0.8.0b1, <=0.8.7) +4 more potentially affected by CVE-2026-48818 via starlette (0.38.2)

starlette PYPI version 0.38.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - acte =0.0.3, =0.8.0b1, =0.1.0, =0.1.1, =0.1.0, =0.1.2 Source cves: CVE-2026-48818 Source advisory: OSV:GHSA-WQP7-X3PW-XC5R...