pip absolute path traversal during download from malicious package indexes

...

OPENSUSE-SU-2026:11466-1 python313-GitPython-3.1.58-1.1 on GA media

These are all security issues fixed in the python313-GitPython-3.1.58-1.1 package on the GA media of openSUSE Tumbleweed...

MAL-2026-13380 Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

ROOT-APP-PYPI-CVE-2024-56201 CVE-2024-56201 in Jinja2 - Patched by Root

Root has patched CVE-2024-56201 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-34064 CVE-2024-34064 in Jinja2 - Patched by Root

Root has patched CVE-2024-34064 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-27516 CVE-2025-27516 in Jinja2 - Patched by Root

Root has patched CVE-2025-27516 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41182 CVE-2026-41182 in langsmith - Patched by Root

Root has patched CVE-2026-41182 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root

Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...

Photon OS 5.0: Python3 PHSA-2025-5.0-92-0595

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-92-0595. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-47781

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781 pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

EUVD-2026-52867

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

CVE-2026-47781

CVE-2026-47781 affects PDM up to v2.26.9, where Core.init() calls load_plugins() and adds the project-local .pdm-plugins via site.addsitedir(). This causes .pth files to be processed, allowing attacker-controlled content in an untrusted repository checkout to execute arbitrary Python code before ...

EUVD-2026-52854

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...