- Latest release
- 1.26.0 (Oct 21, 2026): no advisory affects it
- Newest unaffected release
- 1.26.0 (Oct 21, 2026), the latest release
- Advisories
- 4 · 1 high, 2 medium
- Weekly downloads
- 265.9K
- Dependents
- 43
- Releases
- 129 since 0.1.1 (Oct 30, 2012)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-59991Affects 0.1.1 to 1.17.3 (1.17.4 is outside it)
- CVE-2026-49836Affects 0.1.1 to 1.17.0 (1.17.1 is outside it)
- CVE-2026-27809Affects 0.1.1 to 1.12.1 (1.12.2 is outside it)
- CVE-2020-10571Affects 0.1.1 to 1.9.3 (1.9.4 is outside it)
Advisories 4
- CVE-2026-59991High 7.5
psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry
Affected: fixed in 1.17.4.
Fixed in 1.17.4 (released Jun 24, 2026, 90 days before disclosure).
The latest release, 1.26.0, is not affected.
- CVE-2026-49836Medium 4.6
psd-tools: arbitrary file write via smart-object filename
Affected: fixed in 1.17.1.
Fixed in 1.17.1 (released May 26, 2026, 107 days before disclosure).
The latest release, 1.26.0, is not affected.
- CVE-2026-27809Medium 6.8
psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
Affected: fixed in 1.12.2.
Fixed in 1.12.2 (released Feb 24, 2026, 1 day before disclosure).
The latest release, 1.26.0, is not affected.
- CVE-2020-10571Unrated
An issue was discovered in psd-tools before 1.9.4.
Affected: fixed in 1.9.4; from 1.8.37, fixed in 1.9.4.
Fixed in 1.9.4 (released Mar 11, 2020, 3 days before disclosure).
The latest release, 1.26.0, is not affected.