Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

Malicious code in bfox-build-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293 At install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads...

MAL-2026-17319 Malicious code in bfox-build-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293 At install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads...

Malicious code in queeuees (PyPI)

Source: kam193 1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0 Obfuscated code iterates over files in the system and adds a comment to every .py file found. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-queeuees Reasons...

CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

DEBIAN-CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

UBUNTU-CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

CVE-2026-102904

In JupyterLab versions 4.0.0 through 4.5.11 and 4.6.4, an argument injection vulnerability exists in the PyPI Extension Manager . The ExtensionHandler.post method validates names for installation but fails to reject option-like values during uninstallation, passing them directly to PyPIExtensionM...

CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

Malicious code in queeuees (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f793adc7f1d26294831307abed18a284d7834d8e4733a8b05d9863bf2d70c60d Queeuees 0.0.1 ships two top-level packages, Queeuees and Queues, with byte-identical init.py files. Each init.py assembles a byte blob from...

MAL-2026-17286 Malicious code in queeuees (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f793adc7f1d26294831307abed18a284d7834d8e4733a8b05d9863bf2d70c60d Queeuees 0.0.1 ships two top-level packages, Queeuees and Queues, with byte-identical init.py files. Each init.py assembles a byte blob from...

CVE-2026-102904: Improper Neutralization of Argument Delimiters in a Command

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

PT-2026-102922

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.0.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 Description In the PyPI Extension Manager, the ExtensionHandler.post function validates extension names during installation but fails to reject option-like values...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0token (>=0.1.0, <=0.4.0) +3830 more potentially affected by CVE-2026-93355 via litellm (>=0.1.400, <=1.105.0rc1)

litellm PYPI version =0.1.400, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.0.13, =0.0.13, =0.1.3, =0.0.4, =0.1.0, =0.3.5, =0.1.1.dev1, =0.2.2, =0.2.1, =0.2.0, =0.6.1 and more Source cves: CVE-2026-93355 Source advisory: SNYK:PYTHON-LITELLM-20257373...

Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

MAL-2026-17240 Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...