Vulnerable Library - wandb-0.16.4-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (14 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2026-78676
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
Publish Date: 2026-08-25
URL: CVE-2026-78676
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-284h-m62q-gf8w
Release Date: 2026-08-25
Fix Resolution: gitpython - 3.1.59,gitpython - 3.1.59,https://github.com/gitpython-developers/GitPython.git - 3.1.59
CVE-2026-44243
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-05-07
URL: CVE-2026-44243
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.419%
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-7545-fcxq-7j24
Release Date: 2026-05-05
Fix Resolution (GitPython): 3.1.48
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
CVE-2026-76221
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
Publish Date: 2026-08-19
URL: CVE-2026-76221
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.374%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-jm78-9fvv-mhgr
Release Date: 2026-08-19
Fix Resolution (GitPython): 3.1.58
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
CVE-2026-76220
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
Publish Date: 2026-08-19
URL: CVE-2026-76220
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.463%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-wvpp-8hx9-p66j
Release Date: 2026-08-19
Fix Resolution (GitPython): 3.1.58
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
CVE-2026-73625
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
Publish Date: 2026-08-13
URL: CVE-2026-73625
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.502%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-13
Fix Resolution (GitPython): 3.1.54
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
CVE-2026-67325
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.
Publish Date: 2026-08-01
URL: CVE-2026-67325
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.483%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-2f96-g7mh-g2hx
Release Date: 2026-08-01
Fix Resolution (GitPython): 3.1.51
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
CVE-2026-42215
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
Publish Date: 2026-05-07
URL: CVE-2026-42215
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.749%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-rpm5-65cw-6hj4
Release Date: 2026-05-05
Fix Resolution (GitPython): 3.1.47
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
CVE-2024-6345
Vulnerable Library - setuptools-69.1.1-py3-none-any.whl
Easily download, build, install, upgrade, and uninstall Python packages
Library home page: https://files.pythonhosted.org/packages/c0/7a/3da654f49c95d0cc6e9549a855b5818e66a917e852ec608e77550c8dc08b/setuptools-69.1.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/setuptools-69.1.1.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ setuptools-69.1.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Publish Date: 2024-07-15
URL: CVE-2024-6345
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.939%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-6345
Release Date: 2024-07-15
Fix Resolution (setuptools): 70.0.0
Direct dependency fix Resolution (wandb): 0.16.5
In order to enable automatic remediation, please create workflow rules
CVE-2026-21441
Vulnerable Library - urllib3-2.2.1-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/a2/73/a68704750a7679d0b6d3ad7aa8d4da8e14e151ae82e6fee774e6e0d05ec8/urllib3-2.2.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/urllib3-2.2.1.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- sentry_sdk-1.40.6-py2.py3-none-any.whl
- ❌ urllib3-2.2.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP "Content-Encoding" header (e.g., "gzip", "deflate", "br", or "zstd"). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting "preload_content=False" when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when "preload_content=False". If upgrading is not immediately possible, disable redirects by setting "redirect=False" for requests to untrusted source.
Publish Date: 2026-01-07
URL: CVE-2026-21441
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 2.714%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-38jv-5279-wg99
Release Date: 2026-01-07
Fix Resolution (urllib3): 2.6.3
Direct dependency fix Resolution (wandb): 0.16.5
In order to enable automatic remediation, please create workflow rules
CVE-2026-0994
Vulnerable Library - protobuf-4.25.9-cp37-abi3-manylinux2014_x86_64.whl
No project description provided
Library home page: https://files.pythonhosted.org/packages/a8/5c/53f18822017b8bda6bd8bb4e02048e911fdc79a3dafdc83ab994fe922a84/protobuf-4.25.9-cp37-abi3-manylinux2014_x86_64.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /Pipfile,/tmp/ws-ua_20260825123021_OMDTGG/python_SCNTMZ/202608251230221/env/lib/python3.10/site-packages/protobuf-4.25.9.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ protobuf-4.25.9-cp37-abi3-manylinux2014_x86_64.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
Publish Date: 2026-01-23
URL: CVE-2026-0994
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.688%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-01-23
Fix Resolution: protobuf - 6.33.5,https://github.com/protocolbuffers/protobuf.git - v33.5,https://github.com/protocolbuffers/protobuf.git - v29.6,https://github.com/protocolbuffers/protobuf.git - v3.29.6-objectivec,https://github.com/protocolbuffers/protobuf.git - v5.29.6-cpp,https://github.com/protocolbuffers/protobuf.git - v5.35.0-objectivec,https://github.com/protocolbuffers/protobuf.git - v4.33.5-objectivec,protobuf - 6.33.5
CVE-2025-66471
Vulnerable Library - urllib3-2.2.1-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/a2/73/a68704750a7679d0b6d3ad7aa8d4da8e14e151ae82e6fee774e6e0d05ec8/urllib3-2.2.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/urllib3-2.2.1.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- sentry_sdk-1.40.6-py2.py3-none-any.whl
- ❌ urllib3-2.2.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.
Publish Date: 2025-12-05
URL: CVE-2025-66471
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.692%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-2xpw-w6gg-jr37
Release Date: 2025-12-05
Fix Resolution (urllib3): 2.6.0
Direct dependency fix Resolution (wandb): 0.16.5
In order to enable automatic remediation, please create workflow rules
CVE-2025-66418
Vulnerable Library - urllib3-2.2.1-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/a2/73/a68704750a7679d0b6d3ad7aa8d4da8e14e151ae82e6fee774e6e0d05ec8/urllib3-2.2.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/urllib3-2.2.1.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- sentry_sdk-1.40.6-py2.py3-none-any.whl
- ❌ urllib3-2.2.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Publish Date: 2025-12-05
URL: CVE-2025-66418
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.692%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2025-12-05
Fix Resolution (urllib3): 2.6.0
Direct dependency fix Resolution (wandb): 0.16.5
In order to enable automatic remediation, please create workflow rules
CVE-2026-78675
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.
Publish Date: 2026-08-25
URL: CVE-2026-78675
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (8.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-7833-fr7j-v32q
Release Date: 2026-08-25
Fix Resolution: gitpython - 3.1.59,gitpython - 3.1.59
CVE-2026-67323
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
- wandb-0.16.4-py3-none-any.whl (Root Library)
- ❌ GitPython-3.1.42-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output= can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
Publish Date: 2026-08-01
URL: CVE-2026-67323
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.016%
CVSS 3 Score Details (8.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-956x-8gvw-wg5v
Release Date: 2026-08-01
Fix Resolution (GitPython): 3.1.51
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.
Publish Date: 2026-08-25
URL: CVE-2026-78676
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-284h-m62q-gf8w
Release Date: 2026-08-25
Fix Resolution: gitpython - 3.1.59,gitpython - 3.1.59,https://github.com/gitpython-developers/GitPython.git - 3.1.59
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-05-07
URL: CVE-2026-44243
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.419%
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-7545-fcxq-7j24
Release Date: 2026-05-05
Fix Resolution (GitPython): 3.1.48
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
Publish Date: 2026-08-19
URL: CVE-2026-76221
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.374%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-jm78-9fvv-mhgr
Release Date: 2026-08-19
Fix Resolution (GitPython): 3.1.58
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
Publish Date: 2026-08-19
URL: CVE-2026-76220
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.463%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-wvpp-8hx9-p66j
Release Date: 2026-08-19
Fix Resolution (GitPython): 3.1.58
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
Publish Date: 2026-08-13
URL: CVE-2026-73625
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.502%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-13
Fix Resolution (GitPython): 3.1.54
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.
Publish Date: 2026-08-01
URL: CVE-2026-67325
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.483%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-2f96-g7mh-g2hx
Release Date: 2026-08-01
Fix Resolution (GitPython): 3.1.51
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
Publish Date: 2026-05-07
URL: CVE-2026-42215
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.749%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-rpm5-65cw-6hj4
Release Date: 2026-05-05
Fix Resolution (GitPython): 3.1.47
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - setuptools-69.1.1-py3-none-any.whl
Easily download, build, install, upgrade, and uninstall Python packages
Library home page: https://files.pythonhosted.org/packages/c0/7a/3da654f49c95d0cc6e9549a855b5818e66a917e852ec608e77550c8dc08b/setuptools-69.1.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/setuptools-69.1.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Publish Date: 2024-07-15
URL: CVE-2024-6345
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.939%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-6345
Release Date: 2024-07-15
Fix Resolution (setuptools): 70.0.0
Direct dependency fix Resolution (wandb): 0.16.5
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - urllib3-2.2.1-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/a2/73/a68704750a7679d0b6d3ad7aa8d4da8e14e151ae82e6fee774e6e0d05ec8/urllib3-2.2.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/urllib3-2.2.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP "Content-Encoding" header (e.g., "gzip", "deflate", "br", or "zstd"). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting "preload_content=False" when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when "preload_content=False". If upgrading is not immediately possible, disable redirects by setting "redirect=False" for requests to untrusted source.
Publish Date: 2026-01-07
URL: CVE-2026-21441
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 2.714%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-38jv-5279-wg99
Release Date: 2026-01-07
Fix Resolution (urllib3): 2.6.3
Direct dependency fix Resolution (wandb): 0.16.5
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - protobuf-4.25.9-cp37-abi3-manylinux2014_x86_64.whl
No project description provided
Library home page: https://files.pythonhosted.org/packages/a8/5c/53f18822017b8bda6bd8bb4e02048e911fdc79a3dafdc83ab994fe922a84/protobuf-4.25.9-cp37-abi3-manylinux2014_x86_64.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /Pipfile,/tmp/ws-ua_20260825123021_OMDTGG/python_SCNTMZ/202608251230221/env/lib/python3.10/site-packages/protobuf-4.25.9.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
Publish Date: 2026-01-23
URL: CVE-2026-0994
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.688%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-01-23
Fix Resolution: protobuf - 6.33.5,https://github.com/protocolbuffers/protobuf.git - v33.5,https://github.com/protocolbuffers/protobuf.git - v29.6,https://github.com/protocolbuffers/protobuf.git - v3.29.6-objectivec,https://github.com/protocolbuffers/protobuf.git - v5.29.6-cpp,https://github.com/protocolbuffers/protobuf.git - v5.35.0-objectivec,https://github.com/protocolbuffers/protobuf.git - v4.33.5-objectivec,protobuf - 6.33.5
Vulnerable Library - urllib3-2.2.1-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/a2/73/a68704750a7679d0b6d3ad7aa8d4da8e14e151ae82e6fee774e6e0d05ec8/urllib3-2.2.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/urllib3-2.2.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.
Publish Date: 2025-12-05
URL: CVE-2025-66471
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.692%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-2xpw-w6gg-jr37
Release Date: 2025-12-05
Fix Resolution (urllib3): 2.6.0
Direct dependency fix Resolution (wandb): 0.16.5
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - urllib3-2.2.1-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/a2/73/a68704750a7679d0b6d3ad7aa8d4da8e14e151ae82e6fee774e6e0d05ec8/urllib3-2.2.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/urllib3-2.2.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Publish Date: 2025-12-05
URL: CVE-2025-66418
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.692%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2025-12-05
Fix Resolution (urllib3): 2.6.0
Direct dependency fix Resolution (wandb): 0.16.5
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.
Publish Date: 2026-08-25
URL: CVE-2026-78675
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (8.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-7833-fr7j-v32q
Release Date: 2026-08-25
Fix Resolution: gitpython - 3.1.59,gitpython - 3.1.59
Vulnerable Library - GitPython-3.1.42-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/67/c7/995360c87dd74e27539ccbfecddfb58e08f140d849fcd7f35d2ed1a5f80f/GitPython-3.1.42-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/GitPython-3.1.42.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output= can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
Publish Date: 2026-08-01
URL: CVE-2026-67323
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.016%
CVSS 3 Score Details (8.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-956x-8gvw-wg5v
Release Date: 2026-08-01
Fix Resolution (GitPython): 3.1.51
Direct dependency fix Resolution (wandb): 0.28.1
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules