Most recent entries from pysec

PYSEC-2026-1339 — Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

Tue, 07 Jul 2026 14:34:36 +0000

Affected: PyPI: ethyca-fides

### Note

On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain level to ensure `polyfill.io` and its subdomains could not resolve to the compromised service, rendering this vulnerability **unexploitable**.

The following sections describe this vulnerability prior to the domain level intervention, when it was still exploitable.

### Impact

`fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard.

On June 25th, 2024, Sansec published the following regarding the `polyfill.io` domain.

> The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain... However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io.

Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving `fides.js` to download and execute malicious scripts from the compromised domain.

No exploitation of `fides.js` via `polyfill.io` has been identified at this time, but other script developers who use `https://cdn.polyfill.io/v2/polyfill.min.js` have reported redirects to malicious websites.

### Patches The vulnerability has been patched in Fides version `2.39.…

PYSEC-2026-1497 — kiwi TCMS has possibility for user to update email address to unverified one

Tue, 07 Jul 2026 11:45:18 +0000

Affected: PyPI: kiwitcms

### Impact In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration.

### Patches With Kiwi TCMS v12.2 or later it is not possible to edit the email field associated with a user account!

### Workarounds No workaround exists.

### References Disclosed by [@novemberdad](https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/).

PYSEC-2026-1924 — sigstore CSRF possibility in OIDC authentication during signing

Tue, 07 Jul 2026 16:03:20 +0000

Affected: PyPI: sigstore

### Summary

The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.

### Details

`_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value.

Fix should be fairly trivial.

### Impact

This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.

PYSEC-2026-2480 — Flawfinder output manipulation via untrusted filenames and source text

Mon, 13 Jul 2026 15:46:24 +0000

Affected: PyPI: flawfinder

### Impact

This vulnerability is an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection:

* Terminal Output Spoofing: A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. For example, this might allow an attacker to hide critical scan results, falsely making it appear to a human reviewer that no security issues were found.

* CSV and XML Injection: Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via output_sonar().

It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents.

The initial filename injection problem was reported by Dan Lenz https://www.linkedin.com/in/dan-lenz/

The other vulnerabilities were found by flawfinder project leader David A. Wheeler, GitHub david-a-wheeler, https://dwheeler.com/

### Patches

This issue has been fully patched in Version 2.0.20 (released 2026-05-16). All users should upgrade to version 2.0.20 or later immediately. If you use Python's package manager, you can upgrade using `pip install --upgrade flawfinder`. If you are consuming flawfinder via GitHub Actions, ensure your workflow points to david-a-wheeler/flawfinder@2.0.2…

PYSEC-2026-2551 — Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Mon, 13 Jul 2026 15:46:28 +0000

Affected: PyPI: kiwitcms

## Summary

In Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation. In version 16.1 these fields are properly sanitized and existing database records which don't validate will be reset to a null value.

## Impact

Deployments which use the official Docker images and/or unmodified Kiwi TCMS middleware send a `Content-Security-Policy` header which makes this vulnerability difficult to exploit in practice because this header blocks the browser from executing inline JavaScript. Customized deployments which modify the default security settings may still be vulnerable.

PYSEC-2026-2890 — Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

Mon, 13 Jul 2026 15:02:52 +0000

Affected: PyPI: poetry

### Summary

The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extracts sdist tarballs without path traversal protection on Python versions where `tarfile.data_filter` is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4.

### Impact

Arbitrary file write (path traversal) from untrusted sdist content.

**In practice, the impact is low** because an attacker who exploits this vulnerability can as well include arbitrary code in a `setup.py`, which will be executed when the sdist is built after tar extraction. In other words, a malicious sdist can write arbitrary files by design. However, since it is unexpected and not by design that the file write already happens during tar extraction, this is still considered a vulnerability.

On Python 3.11.2 (Debian Bookworm default, directly tested), a crafted sdist with `../../` tar member paths writes files outside the intended extraction directory. The traversal occurs during metadata resolution (`poetry add --lock`), before the build backend is run.

Affected Environments: - **Python 3.10.0 through 3.10.12** (inclusive): `tarfile.data_filter` absent or broken - **Python 3.11.0 through 3.11.4** (inclusive): `tarfile.data_filter` absent or broken - **Debian Bookworm**: Python 3.11.2 (default) - **Ubuntu 22.04 LTS**: Python 3.10.6 (default)

### Patches

Versions 2.3.4 and newer of Poetry ensure that paths are inside the target directory.

#…

PYSEC-2026-2042 — Weblate has improper validation upon invitation acceptance

Tue, 07 Jul 2026 16:03:12 +0000

Affected: PyPI: weblate

### Impact

It was possible to accept an invitation opened by a different Weblate user.

### Patches

* https://github.com/WeblateOrg/weblate/pull/16913

### Workarounds

Users should avoid leaving Weblate sessions with an unattended opened invitation.

### References

Thanks to Nahid0x for responsibly disclosing this vulnerability to Weblate.

PYSEC-2026-195

Thu, 04 Jun 2026 12:16:24 +0000

Affected: PyPI: mlflow

A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

PYSEC-2026-2516 — Home Assistant has stored XSS in history-graphs

Mon, 13 Jul 2026 14:36:45 +0000

Affected: PyPI: homeassistant

### Summary The "remaining charge time"-sensor for mobile phones (imported/included from Android Auto it appears) is vulnerable to the same issue as CVE-2025-62172. <img width="431" height="334" alt="image" src="https://github.com/user-attachments/assets/84e0dfad-b986-4e84-ad0e-674c5da88582" /> This also indicates that any sensor showing their name in the history-graph, is likely to be vulnerable to this issue.

### Details

Another entity was found which displays the same behavior as in this issue: [CVE-2025-62172](https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m)

The History-graph card will sometimes display the name of the entity it is displaying, when the graph is shown as a line with values on the x and y axis. This appears to be vulnerable to Cross-Site scripting (_XSS_) as it does not have any output escaping or sanitization.

The PoC in this instance only shows HTML-injection in the form of the `<s>` -tag being rendered as strike through, but the vulnerability also allows for injecting arbitrary tags which execute JavaScript, like the example given in the PoC description below.

### PoC 1. Register a new sensor (or device) or change the name of an existing one, which provides a location 2. Change the name to something malicious, for example `test <img src=x onerror=alert(document.domain) />` For a new entity, it should work when setting the name. For old entities, go here: <img width="1300" height="411" alt="image" src="https://gi…

PYSEC-2026-2517 — Home Assistant has stored XSS in Map-card through malicious device name

Mon, 13 Jul 2026 14:36:45 +0000

Affected: PyPI: homeassistant

### Summary An authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point (The lines or the dots representing that device's movement, as shown in the screenshot below, with the example showing a html-injection using `<s>` to strikethrough the text) <img width="348" height="355" alt="image" src="https://github.com/user-attachments/assets/1af3ef33-3a72-4816-8ade-e6405aace176" />

This allows an authenticated user to execute JavaScript in the context of any other users accessing a dashboard.

### Details

The vulnerability exists in the map-card by adding a malicious entity and having the property `hours_to_show` set. See example below, with the malicious entity being `Pixel 9 <s> Fold Robin {{7*7}}`: Map card with malicious device entity: <img width="338" height="332" alt="image" src="https://github.com/user-attachments/assets/15229cc3-1b69-438c-9ee5-cbfa9483aec9" />

YAML-view of same card: <img width="338" height="198" alt="image" src="https://github.com/user-attachments/assets/cd579266-75c3-4cdf-9d08-1544a6887feb" />

This issue largely resembles the issue documented in: [CVE-2025-62172](https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m), but with an entity which can be displayed in a Map, instead of in an energy-dashboard.

### PoC 1. Register a new…