nikgapps (>=3.29.0, <=3.65.0), niklibrary (>=0.35.0, <=0.37.0) +6 more potentially affected by CVE-2026-59890 via setuptools (78.0.2)

setuptools PYPI version 78.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - nikgapps =3.29.0, =0.35.0, =0.5.0, =0.6.11, =0.8.11, =2025.5.23, =2025.5.26 - scancodeio 34.10.1 Source cves: CVE-2026-59890 Source advisor...

Cross-site Scripting (XSS)

scancodeio is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of sanitization in the key parameter of licenses.py, which allows an attacker to inject and execute malicious JavaScript through the /license/ endpoint...

Command Injection

scancodeio is vulnerable to Command Injection. The vulnerability exists due to the lack of validation in the dockerreference parameter of the fetchdockerimage function of fetch.py, which allows an attacker to append malicious commands through the docker fetch process...