https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 23:41:17 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-101171 cnvd-2021-101171 https://cve.radiocsirt.org/vuln/cnvd-2021-101171 https://cve.radiocsirt.org/vuln/euvd-2026-21126 EUVD-2026-21126 https://cve.radiocsirt.org/vuln/euvd-2026-21126 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3840 <p>A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.</p> <p>A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-3840 https://cve.radiocsirt.org/vuln/ghsa-hgc3-hp6x-wpgx <p><strong>Affected:</strong> PyPI: antilles-tools</p> <p>### Potential Impact: Remote code execution.</p> <p>### Scope of Impact: Open-source project specific.</p> <p>### Summary Description: A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.</p> <p>### Mitigation Strategy for Customers (what you should do to protect yourself): Remove previous versions of Antilles as a precautionary measure and Update to version 1.0.1 or later.</p> <p>### Acknowledgement: The Antilles team thanks Kotko Vladyslav for reporting this issue.</p> <p>### References: https://github.com/lenovo/Antilles/commit/c7b9c5740908b343aceefe69733d9972e64df0b9</p> <p><strong>Affected:</strong> PyPI: antilles-tools</p> <p>### Potential Impact: Remote code execution.</p> <p>### Scope of Impact: Open-source project specific.</p> <p>### Summary Description: A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.</p> <p>### Mitigation Strategy for Customers (what you should do to protect yourself): Remove previous versions of Antilles as a precautionary measure and Update to version 1.0.1 or later.</p> <p>### Acknowledgement: The Antilles team thanks Kotko Vladyslav for reporting this issue.</p> <p>### References: https://github.com/lenovo/Antilles/commit/c7b9c5740908b343aceefe69733d9972e64df0b9</p> https://cve.radiocsirt.org/vuln/ghsa-hgc3-hp6x-wpgx https://cve.radiocsirt.org/vuln/gsd-2021-3840 gsd-2021-3840 https://cve.radiocsirt.org/vuln/gsd-2021-3840 https://cve.radiocsirt.org/vuln/pysec-2021-840 <p><strong>Affected:</strong> PyPI: antilles-tools</p> <p>A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.</p> <p><strong>Affected:</strong> PyPI: antilles-tools</p> <p>A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.</p> https://cve.radiocsirt.org/vuln/pysec-2021-840