GHSA-GF2W-JQMQ-FCM8 vulnerabilities

Vulnerabilities for packages: python...

python313-Pillow-12.3.0-1.1 on GA media (moderate)

python313-Pillow-12.3.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11261-1 Rating: moderate Cross-References: CVE-2014-3589 CVE-2014-3598 CVE-2016-0740 CVE-2016-0775 CVE-2016-3076 CVE-2020-15999 CVE-2020-35653 CVE-2020-35654 CVE-2020-35655 CVE-2021-23437 CVE-2021-25289 CVE-2021-25290...

OPENSUSE-SU-2026:11271-1 python313-django-debug-toolbar-7.0.0-1.1 on GA media

These are all security issues fixed in the python313-django-debug-toolbar-7.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

MAL-2026-10484 Malicious code in browser-use-headless (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a85306ba70b361b2851e9e3db9219235556e964e62ad131a7c9760ff63b49b88 The package presents itself as a headless browser-automation helper typosquat of browser-use but contains an appended credential-stealer block. On...

dag-factory (0.23.0a3), dataflow-airflow (>=2.10.5, <=2.10.10) +3 more potentially affected by CVE-2026-27173 via apache-airflow-providers-cncf-kubernetes (>=10.4.2rc1, <=10.10.0)

apache-airflow-providers-cncf-kubernetes PYPI version =10.4.2rc1, =2.10.5, =0.4.3, =0.0.1rc1, =2.10.7rc1, =2.10.11rc5 Source cves: CVE-2026-27173 Source advisory: OSV:PYSEC-2026-2365...

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...

PYSEC-2026-2876 pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...

auto-browse (>=0.0.2, <=0.0.5), clai (>=1.34.0, <=1.50.0) +14 more potentially affected by CVE-2026-25640 via pydantic-ai-slim (>=1.34.0, <=1.50.0)

pydantic-ai-slim PYPI version =1.34.0, =0.0.2, =1.34.0, =0.1.0, =1.0.0, =26.0.0, =0.4.3b0, =1.34.0, =1.34.0, =1.34.0, =0.6.3.dev1, =0.45.2, =0.1.0, =0.1.3 and more Source cves: CVE-2026-25640 Source advisory: OSV:PYSEC-2026-2983...

a2grunnerp (>=0.1.0, <=0.1.8), aisdc (1.0.1) +43 more potentially affected by CVE-2022-41911 via tensorflow (2.10.0)

tensorflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - a2grunnerp =0.1.0, =0.1.1b2, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.7.0, =1.0.0 - cv2-group 0.2.0 - decimer-segmentation 1.1.1 and more Source...

aadhaar-detection (0.5.0), abmarl (>=0.1.1, <=0.1.3) +706 more potentially affected by CVE-2022-41893 via tensorflow (>=2.0.0, <=2.8.3)

tensorflow PYPI version =2.0.0, =0.1.1, =1.0.47, =1.0.0, =6.0.0, =1.2.0, =1.2.8, =1.1.5, =0.0.1, =2.1.0, =7.1.5 and more Source cves: CVE-2022-41893 Source advisory: OSV:PYSEC-2026-3118...

Malicious code in turbocalcng (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f668de627f83b0348d681edd090804f202add609fdc9a3c671f987608fb448 turbocalcng/init.py imports arithmetic.py, which — beneath a facade of arithmetic helpers — contains an XOR-obfuscated in-memory native code executio...

CVE-2026-15519

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file systemprompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely...

CVE-2026-15519 usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file systemprompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely...

EUVD-2026-43262

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file systemprompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely...

CVE-2026-15519 usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file systemprompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely...

CVE-2026-15519

The CVE-2026-15519 entry affects usestrix strix up to 1.0.2, specifically the PyPI Handler’s file system_prompt.jinja. A manipulation can cause inclusion of functionality from an untrusted control sphere. The vulnerability is exploitable remotely with network impact and a high attack complexity; ...

PT-2026-57606

Name of the Vulnerable Software and Affected Versions usestrix strix versions prior to 1.0.3 Description A remote issue exists in the PyPI Handler component within the system prompt.jinja file. Manipulation of this component allows the inclusion of functionality from an untrusted control sphere...

MAL-2026-10215 Malicious code in fast-dotenv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3250a4b69ccce49128d2e75ffb9e577746de4fb3afe0e0d242fbe5d094d02d The package presents itself as a.env loader but on load/config spawns a background thread that, after a 72–96 hour activation delay jittered by...

MAL-2026-10196 Malicious code in jupiter-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e0901ca45da110106c60f288b0166fc51c348a44569d7e7ff22af3d19deafe On import jupitersdk, the package's top-level init.py fetches a payload over HTTPS from a public IPFS gateway...

MAL-2026-10194 Malicious code in solidity-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30501f6602a5b5b436ef5d6224ec332fa866c9e8b9da4d0de3bc69de868b1fff soliditydev/init.py contains a large base64-encoded Linux x8664 ELF binary in PAYLOADB64. On import soliditydev, the module decodes the blob, writes ...