1password-secrets (>=0.0.1.dev107, <=0.4.0), 42towels (>=0.1.1001, <=0.1.1011) +2378 more potentially affected by CVE-2026-28684 via python-dotenv (>=1.0.0, <=1.2.1)

python-dotenv PYPI version =1.0.0, =0.0.1.dev107, =0.1.1001, =2.3.0, =0.0.15, =0.15.1, =0.1.0, =0.1.0, =1.0.0, =2.3.9b1, =1.18.8, =0.1.0b0, =0.0.1, =0.0.0, =4.8.2, =4.8.399 and more Source cves: CVE-2026-28684 Source advisory: OSV:PYSEC-2026-2270...

argus-dynamixel (0.1.0), argus-rico (0.0.1) +44 more potentially affected by CVE-2026-28684 via python-dotenv (0.18.0)

python-dotenv PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - argus-dynamixel 0.1.0 - argus-rico 0.0.1 - bert-squeeze =0.1.0, =0.0.1, =0.0.1, =0.1.0, =2.0.0, =1.0.0, =1.3.0, =1.1.0, =1.0.0, =0.6....

aea (>=1.0.2, <=1.2.5), aea-cli-ipfs (>=1.0.0rc1, <=1.0.4) +92 more potentially affected by CVE-2026-28684 via python-dotenv (0.17.1)

python-dotenv PYPI version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - aea =1.0.2, =1.0.0rc1, =1.0.0rc1, =1.0.0rc1, =1.0.0rc1, =1.0.9, =0.1.0, =0.1.3, =0.1.11 - bloomtechlib 0.0.1 - comon-crawler 0.9.8 -...

abstract-python-email-validation (>=0.1.1, <=1.0.0), abstract-python-exchange-rates (>=1.0.0, <=1.0.1) +21 more potentially affected by CVE-2026-28684 via python-dotenv (0.17.0)

python-dotenv PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - abstract-python-email-validation =0.1.1, =1.0.0, =0.1.0, =0.1.0, =1.1.5, =0.0.3, =1.3.3, =1.0.1, =0.11.0, =0.0.3, =0.0.1, =0.3.0,...

acru-l (>=1.0.0a0, <=1.0.0a6), akc-mamba (>=2.1.0a1, <=2.1.2a0) +182 more potentially affected by CVE-2026-28684 via python-dotenv (0.15.0)

python-dotenv PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - acru-l =1.0.0a0, =2.1.0a1, =1.0.0, =0.1.0, =1.4.0, =0.0.5, =0.6.2, =1.0.0, =0.1.1, =2021.10.11.4, =0.1.2, =0.1.8 and more Source cves...

alcali (3003.1.0), am4894ga (>=0.0.1, <=0.0.6) +75 more potentially affected by CVE-2026-28684 via python-dotenv (0.14.0)

python-dotenv PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - alcali 3003.1.0 - am4894ga =0.0.1, =0.1.0, =0.0.0, =0.2.2, =1.7.3, =0.1.1, =0.1.1, =0.1.0, =0.1.39, =0.0.29, =0.0.33 and more Source...

a7a1234 (1.0.0), ai-jarvis (>=0.0.2, <=0.0.3) +107 more potentially affected by CVE-2026-28684 via python-dotenv (0.21.0)

python-dotenv PYPI version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - a7a1234 1.0.0 - ai-jarvis =0.0.2, =0.1.0, =0.0.2, =0.0.2, =0.0.3, =1.0.0, =0.6.3, =0.1.4, =0.1.21, =0.0.1, =1.0.2, =1.0.0, =1.0.1 and...

boss-cli (>=1.0.0a18, <=1.0.3), lore (0.4.36) +1 more potentially affected by CVE-2026-28684 via python-dotenv (0.6.5)

python-dotenv PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - boss-cli =1.0.0a18, =0.1.16, =0.1.20 Source cves: CVE-2026-28684 Source advisory: OSV:PYSEC-2026-2270...

PYSEC-2026-2270

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

CVE-2026-28684

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

UBUNTU-CVE-2026-28684

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

CVE-2026-28684

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

CVE-2026-28684 python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

CVE-2026-28684 python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

CVE-2026-28684 python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

CVE-2026-28684

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

1password-secrets (>=0.0.1.dev78, <=0.4.0), 2m (1.2.5) +4190 more potentially affected by CVE-2026-28684 via python-dotenv (>=0.1.0, <=1.2.1)

python-dotenv PYPI version =0.1.0, =0.0.1.dev78, =0.1.1001, =2.3.0, =0.0.15, =0.15.1, =0.1.0, =0.1.0, =1.0.0, =2.3.9b1, =0.7.1, =1.18.8, =0.1.1, =1.0.0 and more Source cves: CVE-2026-28684 Source advisory: MEND:CVE-2026-28684...

CVE-2026-28684

CVE-2026-28684 (python-dotenv) : The issue affects python-dotenv where the functions set_key() and unset_key() follow symbolic links when rewriting the .env file. This behavior enables a local attacker to overwrite arbitrary files via a crafted symlink during a cross-device rename fallback. Impac...

CVE-2026-28684: Improper Link Resolution Before File Access

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...

PT-2026-33800

Name of the Vulnerable Software and Affected Versions python-dotenv versions prior to 1.2.2 Description The set key and unset key functions in python-dotenv follow symbolic links when rewriting .env files. This occurs when the rewrite context manager in dotenv/main.py writes to a temporary file i...