CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

OESA-2026-3788 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

OESA-2026-3786 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

OESA-2026-3785 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

pip absolute path traversal during download from malicious package indexes

...

pip would incorrectly handle doubly-encoded package URLs from indexes

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

Malicious code in newpackagetest2025 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb87fd7186acc9af957e5155c0bfda87798fa733efdea43ff60f647c3eb439a0 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12189 Malicious code in advdef01 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 44ffce32113cbe3c908fd584f4b02617cafcfecccc3cea1c4fc068021c4bfa7d Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

Malicious code in selfhackedloadnvidia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a9fdda217a1686954a076ef1fd47c13ac479ca8a494983cc7d29d35092bf949f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfstudygrand (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b1a0cd3f0b8eaf918a692bf98b6bdbc6e87478cfb0ec52d69e5dcdeeec97557a EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqrandomintel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0a697d3b3055bc209eb6e5e064cc1214b288f40d23b71f24cff4b0ae7650b590 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in adad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1d44cddd5d17caac8b0f78bacaea1466b4c1a3a042be2322e6de94f538e3da8b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in virtualurl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b36ea7170408477447d3a99c8d23a4ebcc8c68be960003fc5a5a0d3cca1b2111 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in posthttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c46bd22ff3a0b039529c0216089505a6996d1834d8348a2eca9ab9f944ccc1aa EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...