EUVD-2025-30898

Malicious code in bioql PyPI...

dev.i10416:slackapis-core_3 (>=0.0.1 <=0.0.2), es.weso:schema_3 (>=0.1.103 <=0.2.4) +21 more potentially affected by CVE-2025-59822 via org.http4s:http4s-ember-core_3 (>=1.0.0-M22 <=1.0.0-M44)

org.http4s:http4s-ember-core3 MAVEN version =1.0.0-M22, =0.0.1, =0.1.103, =0.1.103, =0.1.103, =0.1.93, =0.1.109, =0.1.93, =0.1.102, =0.1.1, =0.0.13, =0.1.93, =0.19.0, =0.1.0, =0.1.7 and more Source cves: CVE-2025-59822 Source advisory: SNYK:JAVA-ORGHTTP4S-13019560...

ch.epfl.bluebrain.nexus:cli_2.13 (>=1.5.0 <=1.6.1), com.47deg:github4s_2.13 (>=0.22.0 <=0.28.5) +299 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.13 (>=0.21.0-M1 <=0.21.33)

org.http4s:http4s-core2.13 MAVEN version =0.21.0-M1, =1.5.0, =0.22.0, =0.2.0, =0.2.0, =0.1.0, =1.3.1, =1.3.1, =0.6.1, =0.13.1, =0.11.2, =0.12.1, =0.7.2, =0.13.1, =0.13.2 - com.avast.cloud:datadog4s3.0.0-M2 =0.11.1 and more Source cves: CVE-2023-22465 Source advisory: OSV:GHSA-54W6-VXFH-FW7F...

com.banno:vault4s_2.11 (>=5.0.0 <=5.2.0-M6), com.ccadllc.cedi:dtrace-http4s_2.11 (>=2.0.0 <=2.0.2) +66 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.11 (>=0.20.0-M1 <=0.21.0-M1)

org.http4s:http4s-core2.11 MAVEN version =0.20.0-M1, =5.0.0, =2.0.0, =1.1.0, =1.0-RC3, =0.11.0, =0.38, =0.38, =0.38, =0.1.0, =0.1.0, =8.4.0, =2.0.0-M1, =1.6.4, =0.7.8, =0.8.11 and more Source cves: CVE-2023-22465 Source advisory: OSV:GHSA-54W6-VXFH-FW7F...

ch.j3t:zio-prefetcher_2.12 (=0.8.0-RC6), com.47deg:github4s_2.12 (>=0.29.1 <=0.32.0) +155 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.12 (>=0.23.0 <=0.23.16)

org.http4s:http4s-core2.12 MAVEN version =0.23.0, =0.29.1, =0.31.0, =0.5.0, =0.9.4, =0.17.0, =0.12.1, =0.12.1, =0.17.1 and more Source cves: CVE-2023-22465 Source advisory: OSV:GHSA-54W6-VXFH-FW7F...

ch.epfl.bluebrain.nexus:cli_2.13 (>=1.5.0 <=1.6.1), com.47deg:github4s_2.13 (>=0.22.0 <=0.28.5) +132 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.10.0-M10 <=0.21.28)

org.http4s:http4s-client2.13 MAVEN version =0.10.0-M10, =1.5.0, =0.22.0, =0.2.0, =0.2.0, =0.1.0, =1.3.1, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =6.0.0, =0.0.38, =0.0.38, =0.0.38, =0.0.42 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

http4s path traversal vulnerability

http4s is an open source for Scala streaming HTTP server . A path traversal vulnerability exists in FileService, ResourceService, and WebjarService in http4s versions prior to 0.18.26, 0.20.20, and 0.21.2, which stems from the program's failure to properly normalize URLs. An attacker can exploit...