106 matches found
CVE-2026-28684: Improper Link Resolution Before File Access
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv follow symbolic links when rewriting .env files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a...
Malicious Package
Overview python-dotenv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malware in python-dotenv
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in python-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bf133022adafc8949f152dac2e99730580ca64a570cf0aeae36b7f81f3c1db9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-48037 Malicious code in python-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bf133022adafc8949f152dac2e99730580ca64a570cf0aeae36b7f81f3c1db9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
