https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 11:56:02 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32714 <p><strong>Affected:</strong> scitokens</p> <p>SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python&#39;s str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in version 1.9.6.</p> <p><strong>Affected:</strong> scitokens</p> <p>SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python&#39;s str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in version 1.9.6.</p> https://cve.radiocsirt.org/vuln/cve-2026-32714 https://cve.radiocsirt.org/vuln/ghsa-rh5m-2482-966c <p><strong>Affected:</strong> PyPI: scitokens</p> <p>### Summary The `KeyCache` class in `scitokens` was vulnerable to SQL Injection because it used Python&#39;s `str.format()` to construct SQL queries with user-supplied data (such as `issuer` and `key_id`). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database.</p> <p>Ran the POC below locally.</p> <p>### Details **File:** `src/scitokens/utils/keycache.py`</p> <p>### Vulnerable Code Snippets</p> <p>**1. In `addkeyinfo` (around line 74):** ```python curs.execute(&#34;DELETE FROM keycache WHERE issuer = &#39;{}&#39; AND key_id = &#39;{}&#39;&#34;.format(issuer, key_id)) ```</p> <p>**2. In `_addkeyinfo` (around lines 89 and 94):** ```python insert_key_statement = &#34;INSERT OR REPLACE INTO keycache VALUES(&#39;{issuer}&#39;, &#39;{expiration}&#39;, &#39;{key_id}&#39;, \ &#39;{keydata}&#39;, &#39;{next_update}&#39;)&#34; # ... curs.execute(insert_key_statement.format(issuer=issuer, expiration=time.time()+cache_timer, key_id=key_id, keydata=json.dumps(keydata), next_update=time.time()+next_update)) ```</p> <p>**3. In `_delete_cache_entry` (around line 128):** ```python curs.execute(&#34;DELETE FROM keycache WHERE issuer = &#39;{}&#39; AND key_id = &#39;{}&#39;&#34;.format(issuer, key_id)) ```</p> <p>**4. In `_add_negative_cache_entry` (around lines 148 and 152):** ```python insert_key_statement = &#34;INSERT OR REPLACE INTO keycache VALUES(&#39;{issuer}&#39;, &#39;{expiration}&#39;, &#39;{key_id}&#39;, \ &#39;{keydata}&#39;, &#39;{next_update}&#39;)&#34; # ... curs.execute(insert_key_statement.format(issuer=issuer, expiration=time.ti…</p> <p><strong>Affected:</strong> PyPI: scitokens</p> <p>### Summary The `KeyCache` class in `scitokens` was vulnerable to SQL Injection because it used Python&#39;s `str.format()` to construct SQL queries with user-supplied data (such as `issuer` and `key_id`). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database.</p> <p>Ran the POC below locally.</p> <p>### Details **File:** `src/scitokens/utils/keycache.py`</p> <p>### Vulnerable Code Snippets</p> <p>**1. In `addkeyinfo` (around line 74):** ```python curs.execute(&#34;DELETE FROM keycache WHERE issuer = &#39;{}&#39; AND key_id = &#39;{}&#39;&#34;.format(issuer, key_id)) ```</p> <p>**2. In `_addkeyinfo` (around lines 89 and 94):** ```python insert_key_statement = &#34;INSERT OR REPLACE INTO keycache VALUES(&#39;{issuer}&#39;, &#39;{expiration}&#39;, &#39;{key_id}&#39;, \ &#39;{keydata}&#39;, &#39;{next_update}&#39;)&#34; # ... curs.execute(insert_key_statement.format(issuer=issuer, expiration=time.time()+cache_timer, key_id=key_id, keydata=json.dumps(keydata), next_update=time.time()+next_update)) ```</p> <p>**3. In `_delete_cache_entry` (around line 128):** ```python curs.execute(&#34;DELETE FROM keycache WHERE issuer = &#39;{}&#39; AND key_id = &#39;{}&#39;&#34;.format(issuer, key_id)) ```</p> <p>**4. In `_add_negative_cache_entry` (around lines 148 and 152):** ```python insert_key_statement = &#34;INSERT OR REPLACE INTO keycache VALUES(&#39;{issuer}&#39;, &#39;{expiration}&#39;, &#39;{key_id}&#39;, \ &#39;{keydata}&#39;, &#39;{next_update}&#39;)&#34; # ... curs.execute(insert_key_statement.format(issuer=issuer, expiration=time.ti…</p> https://cve.radiocsirt.org/vuln/ghsa-rh5m-2482-966c