melon-music-player (3.0.0a0) potentially affected by CVE-2026-32889 via tinytag (0.18.0)

tinytag PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - melon-music-player 3.0.0a0 Source cves: CVE-2026-32889 Source advisory: OSV:GHSA-F4RQ-2259-HV29...

helperpy (>=0.0.1, <=0.0.4) potentially affected by CVE-2026-32889 via tinytag (1.5.0)

tinytag PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - helperpy =0.0.1, =0.0.4 Source cves: CVE-2026-32889 Source advisory: OSV:GHSA-F4RQ-2259-HV29...

bosesoundtouchapi (>=1.0.20, <=1.0.87) potentially affected by CVE-2026-32889 via tinytag (1.10.0)

tinytag PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinytag and may be impacted: - bosesoundtouchapi =1.0.20, =1.0.87 Source cves: CVE-2026-32889 Source advisory: OSV:GHSA-F4RQ-2259-HV29...

bsh-file-validation (>=0.0.4, <=0.0.21), kaithem (0.95.0) +2 more potentially affected by CVE-2026-32889 via tinytag (>=2.1.0, <=2.2.0)

tinytag PYPI version =2.1.0, =0.0.4, =0.11.12rc1, =0.11.12 - pyplanet-currentcps 1.1.0 Source cves: CVE-2026-32889 Source advisory: OSV:GHSA-F4RQ-2259-HV29...

CVE-2026-32889

creationtimestamp| type| source ---|---|--- 2026-03-19 16:10:20+00:00| published-proof-of-concept| https://github.com/tinytag/tinytag/security/advisories/GHSA-f4rq-2259-hv29...

PT-2026-26463

Name of the Vulnerable Software and Affected Versions tinytag versions 2.2.0 Description tinytag version 2.2.0 contains an issue where an attacker who can supply MP3 files for parsing can trigger a non-terminating loop while the library parses an ID3v2 SYLT synchronized lyrics frame. In server-si...