- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 2 critical, 4 medium, 4 low
- Registry
- PyPI
Advisories 10
- CVE-2026-14967Low 3.1
Path traversal in github_workflows allows writing artifacts outside output directory
Affected: from 1.1.7, fixed in 3.0.0.
- CVE-2026-14966Low 3.1
Symlink guard bypass in unarchive module allows planting symlinks during extraction
Affected: from 2.3.1, fixed in 3.0.0.
- CVE-2026-12568Medium 6.5
Arbitrary File Write in postman_download module
Affected: from 2.1.0, fixed in 2.8.6.
- CVE-2026-12567Low 2.2
Symlink-following arbitrary write via github_workflows module
Affected: from 2.0.0, fixed in 2.8.5.
- CVE-2026-12566Low 3.1
SSRF via unvalidated WWW-Authenticate realm in docker_pull module
Affected: from 2.0.0, fixed in 2.8.5.
- CVE-2026-12565Medium 5.3
Path Traversal (Zip-Slip) in unarchive module
Affected: from 2.3.1, fixed in 2.8.5.
- CVE-2025-10284Critical 9.6
Improper Archive Extraction in unarchive Enables RCE
Affected: through 2.6.1; fixed in 2.7.0.
- CVE-2025-10283Critical 9.6
Improper .git Sanitization in gitdumper Enables RCE
Affected: through 2.6.1; fixed in 2.7.0.
- CVE-2025-10282Medium 4.7
GitLab Domain Confusion in gitlab Leaks API Key
Affected: through 2.6.1; fixed in 2.7.2; from 2.7.0.6919rc0, fixed in 2.7.2.
- CVE-2025-10281Medium 4.7
Insecure URL Handling in git_clone Leading to Leaked API Key
Affected: through 2.6.1; fixed in 2.7.0.