autotrain-advanced (>=0.7.102, <=0.7.118), genrag (0.1.0) +9 more potentially affected by CVE-2026-9856 via transformers (4.41.0)

transformers PYPI version 4.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.7.102, =0.1.10, =0.1.0, =0.0.9, =0.0.3.post33, =0.0.1, =0.0.1, =0.0.90, =2.5.1, =2.5.5 Source cves: CVE-2026-9856...

instawow (>=1.6.3, <=1.6.4) potentially affected by CVE-2026-34444 via lupa (1.9.0)

lupa PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on lupa and may be impacted: - instawow =1.6.3, =1.6.4 Source cves: CVE-2026-34444 Source advisory: OSV:PYSEC-2026-2613...

asimov-agents (>=0.0.3, <=0.1.2), dcspy (>=3.6.2, <=3.8.1) +1 more potentially affected by CVE-2026-34444 via lupa (>=2.2.0, <=2.6.0)

lupa PYPI version =2.2.0, =0.0.3, =3.6.2, =3.8.1 - draw-palette 0.3.0 Source cves: CVE-2026-34444 Source advisory: OSV:PYSEC-2026-2613...

instawow (>=1.6.0, <=1.6.2.1), pycharsheet (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-34444 via lupa (1.8.0)

lupa PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on lupa and may be impacted: - instawow =1.6.0, =0.0.1, =0.0.4 Source cves: CVE-2026-34444 Source advisory: OSV:PYSEC-2026-2613...

corva-sdk (>=1.4.0rc1, <=1.12.1), dosh-core (>=0.1.1, <=0.3.0) +1 more potentially affected by CVE-2026-34444 via lupa (1.14.1)

lupa PYPI version 1.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on lupa and may be impacted: - corva-sdk =1.4.0rc1, =0.1.1, =0.0.4, =0.1.1 Source cves: CVE-2026-34444 Source advisory: OSV:PYSEC-2026-2613...

Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

SummaryThe attributefilter in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.However, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to...

PT-2026-59267

Summary The attribute filter in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua. However, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to...

autotrain-advanced (>=0.7.102, <=0.7.118), genrag (0.1.0) +9 more potentially affected by CVE-2026-5241 via transformers (4.41.0)

transformers PYPI version 4.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.7.102, =0.1.10, =0.1.0, =0.0.9, =0.0.3.post33, =0.0.1, =0.0.1, =0.0.90, =2.5.1, =2.5.5 Source cves: CVE-2026-5241...

autotrain-advanced (>=0.7.102, <=0.7.118), genrag (0.1.0) +9 more potentially affected by CVE-2026-4372 via transformers (4.41.0)

transformers PYPI version 4.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.7.102, =0.1.10, =0.1.0, =0.0.9, =0.0.3.post33, =0.0.1, =0.0.1, =0.0.90, =2.5.1, =2.5.5 Source cves: CVE-2026-4372...

autotrain-advanced (>=0.7.102, <=0.7.118), genrag (0.1.0) +9 more potentially affected by CVE-2026-4372 via transformers (4.41.0)

transformers PYPI version 4.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.7.102, =0.1.10, =0.1.0, =0.0.9, =0.0.3.post33, =0.0.1, =0.0.1, =0.0.90, =2.5.1, =2.5.5 Source cves: CVE-2026-4372...

python311-lupa-2.7-1.1 on GA media (moderate)

python311-lupa-2.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:10507-1 Rating: moderate Cross-References: CVE-2026-34444 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

OPENSUSE-SU-2026:10507-1 python311-lupa-2.7-1.1 on GA media

These are all security issues fixed in the python311-lupa-2.7-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-34444

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attributefilter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitra...

asimov-agents (>=0.0.3, <=0.1.2), dcspy (>=3.6.2, <=3.8.1) +1 more potentially affected by CVE-2026-34444 via lupa (>=2.2.0, <=2.6.0)

lupa PYPI version =2.2.0, =0.0.3, =3.6.2, =3.8.1 - draw-palette 0.3.0 Source cves: CVE-2026-34444 Source advisory: SNYK:PYTHON-LUPA-15954200...

asimov-agents (>=0.0.3, <=0.1.2), dcspy (>=3.6.2, <=3.8.1) +1 more potentially affected by CVE-2026-34444 via lupa (>=2.2.0, <=2.6.0)

lupa PYPI version =2.2.0, =0.0.3, =3.6.2, =3.8.1 - draw-palette 0.3.0 Source cves: CVE-2026-34444 Source advisory: GHSA-69V7-XPR6-6GJM...

GHSA-69V7-XPR6-6GJM Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

Summary The attributefilter in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua. However, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to...

corva-sdk (>=1.4.0rc1, <=1.12.1), dosh-core (>=0.1.1, <=0.3.0) +1 more potentially affected by CVE-2026-34444 via lupa (1.14.1)

lupa PYPI version 1.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on lupa and may be impacted: - corva-sdk =1.4.0rc1, =0.1.1, =0.0.4, =0.1.1 Source cves: CVE-2026-34444 Source advisory: OSV:GHSA-69V7-XPR6-6GJM...

instawow (>=1.6.0, <=1.6.2.1), pycharsheet (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-34444 via lupa (1.8.0)

lupa PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on lupa and may be impacted: - instawow =1.6.0, =0.0.1, =0.0.4 Source cves: CVE-2026-34444 Source advisory: OSV:GHSA-69V7-XPR6-6GJM...

instawow (>=1.6.3, <=1.6.4) potentially affected by CVE-2026-34444 via lupa (1.9.0)

lupa PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on lupa and may be impacted: - instawow =1.6.3, =1.6.4 Source cves: CVE-2026-34444 Source advisory: OSV:GHSA-69V7-XPR6-6GJM...

asimov-agents (>=0.0.3, <=0.1.2), dcspy (>=3.6.2, <=3.8.1) +1 more potentially affected by CVE-2026-34444 via lupa (>=2.2.0, <=2.6.0)

lupa PYPI version =2.2.0, =0.0.3, =3.6.2, =3.8.1 - draw-palette 0.3.0 Source cves: CVE-2026-34444 Source advisory: OSV:GHSA-69V7-XPR6-6GJM...