CVE-2026-40491

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members...

cytoself (0.0.1.1) potentially affected by CVE-2026-40491 via gdown (3.6.4)

gdown PYPI version 3.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - cytoself 0.0.1.1 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

molmap (>=1.3.1, <=1.3.5) potentially affected by CVE-2026-40491 via gdown (3.8.3)

gdown PYPI version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - molmap =1.3.1, =1.3.5 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

brainmri-ps (>=0.1.7, <=0.1.8), decto (>=0.1.0, <=0.1.2) +5 more potentially affected by CVE-2026-40491 via gdown (3.11.0)

gdown PYPI version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - brainmri-ps =0.1.7, =0.1.0, =0.1.0, =0.1.10, =0.1.1, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

forest-utils (>=0.0.7, <=1.0.2), lungs (>=0.1.0, <=0.1.5) potentially affected by CVE-2026-40491 via gdown (3.11.1)

gdown PYPI version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - forest-utils =0.0.7, =0.1.0, =0.1.5 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

fastestimator (>=1.1.1, <=1.5.2), fastestimator-nightly (>=1.1.0.dev202008151147, <=1.5.0.dev202304171323) +2 more potentially affected by CVE-2026-40491 via gdown (3.12.0)

gdown PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - fastestimator =1.1.1, =1.1.0.dev202008151147, =0.3.0, =1.9.1 - nkocr 1.1.0 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

adaptnlp (>=0.3.4, <=0.3.7), clarinpl-embeddings (>=0.0.1rc2, <=0.0.1rc158956732038) +16 more potentially affected by CVE-2026-40491 via gdown (3.12.2)

gdown PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - adaptnlp =0.3.4, =0.0.1rc2, =0.0.1rc0, =1.3.0, =0.2.5, =0.8.0, =0.1.1.dev2, =1.8.1, =0.1.1, =0.1.1, =0.0.1, =1.0.3 and more Source cves: CVE-2026-404...

boolean-question (0.0.3), deep-floorplan (0.0.0) +1 more potentially affected by CVE-2026-40491 via gdown (3.13.0)

gdown PYPI version 3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - boolean-question 0.0.3 - deep-floorplan 0.0.0 - livermask =1.3.1rc2, =1.3.1 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

soccer-twos (>=0.1.8, <=0.1.12) potentially affected by CVE-2026-40491 via gdown (3.14.0)

gdown PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - soccer-twos =0.1.8, =0.1.12 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

fsdtorch (>=0.1.0, <=0.1.2.1), torch-conduit (>=0.1.1, <=0.1.6) +1 more potentially affected by CVE-2026-40491 via gdown (3.15.0)

gdown PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - fsdtorch =0.1.0, =0.1.1, =1.2.0, =1.3.0 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

nkocr (2.0.2) potentially affected by CVE-2026-40491 via gdown (4.0.2)

gdown PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - nkocr 2.0.2 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

aydin (>=0.1.11, <=0.1.15rc0), neurips-cellseg-gc (>=0.0.1, <=0.0.8) potentially affected by CVE-2026-40491 via gdown (4.2.0)

gdown PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - aydin =0.1.11, =0.0.1, =0.0.8 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

cppe5 (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-40491 via gdown (4.2.2)

gdown PYPI version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - cppe5 =0.1.0, =0.1.1 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

cytoself (>=0.0.1.2, <=0.0.1.4) potentially affected by CVE-2026-40491 via gdown (4.3.0)

gdown PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - cytoself =0.0.1.2, =0.0.1.4 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

dadmatools (>=1.4.0, <=1.5.0), draupnir (>=0.0.2, <=0.0.193) potentially affected by CVE-2026-40491 via gdown (4.3.1)

gdown PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - dadmatools =1.4.0, =0.0.2, =0.0.193 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

accutuning-helpers (>=1.0.32, <=1.0.33), adaptnlp (>=0.3.0, <=0.3.3) +23 more potentially affected by CVE-2026-40491 via gdown (4.4.0)

gdown PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - accutuning-helpers =1.0.32, =0.3.0, =0.1.0, =0.1.0, =0.0.7, =0.0.2, =1.16.15, =0.11.3, =0.2.2, =0.0.1, =0.1.1, =1.3.6, =3.9.1 and more Source cves:...

fairyfishnet (>=1.16.19, <=1.16.20), nerfstudio (>=0.0.1, <=0.1.13) +8 more potentially affected by CVE-2026-40491 via gdown (4.5.1)

gdown PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - fairyfishnet =1.16.19, =0.0.1, =0.0.10, =0.3.0, =0.1.4, =1.0.0, =1.3.0, =1.0.0, =1.1.3 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-215...

fairyfishnet (1.16.21), lddl (0.1.0) +2 more potentially affected by CVE-2026-40491 via gdown (4.5.3)

gdown PYPI version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - fairyfishnet 1.16.21 - lddl 0.1.0 - livermask =1.4.0, =0.0.18, =0.0.21 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

lidarsuit (0.1.6), lidarwind (>=0.2.1, <=0.2.3) +1 more potentially affected by CVE-2026-40491 via gdown (4.5.4)

gdown PYPI version 4.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - lidarsuit 0.1.6 - lidarwind =0.2.1, =1.0.0, =1.0.1 Source cves: CVE-2026-40491 Source advisory: OSV:PYSEC-2026-2158...

bent (>=0.0.9, <=0.0.80), bgnlp (>=0.0.6, <=0.4.1) +8 more potentially affected by CVE-2026-40491 via gdown (4.6.0)

gdown PYPI version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on gdown and may be impacted: - bent =0.0.9, =0.0.6, =0.1.1, =0.0.9, =0.66.1, =0.1.14, =1.0.0a1.post0, =0.1.1, =1.0.0, =1.0.2 Source cves: CVE-2026-40491 Source advisory:...