- Latest release
- 1.1.4 (Oct 12, 2026): no advisory affects it
- Newest unaffected release
- 1.1.4 (Oct 12, 2026), the latest release
- Advisories
- 4 · 1 critical, 3 high
- Weekly downloads
- 2.7M
- Dependents
- 425
- Releases
- 166 since 0.0.3 (Apr 22, 2019)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-55206Affects 0.0.3 to 1.1.2 (1.1.3 is outside it)
- CVE-2026-55195Affects 0.0.3 to 1.1.2 (1.1.3 is outside it)
- CVE-2026-23879Affects 0.0.3 to 1.1.2 (1.1.3 is outside it)
- CVE-2022-44900Affects 0.0.3 to 0.20.0 (0.20.1 is outside it)
Advisories 4
- CVE-2026-55206High 8.7
py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
Affected: fixed in 1.1.3.
Fixed in 1.1.3 (released Jun 19, 2026, 19 days before disclosure).
The latest release, 1.1.4, is not affected.
- CVE-2026-55195High 8.7
py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
Affected: fixed in 1.1.3.
Fixed in 1.1.3 (released Jun 19, 2026, 19 days before disclosure).
The latest release, 1.1.4, is not affected.
- CVE-2026-23879High 8.0
py7zr: Arbitrary File Write Vulnerability
Affected: fixed in 1.1.3.
Fixed in 1.1.3 (released Jun 19, 2026, 5 days before disclosure).
The latest release, 1.1.4, is not affected.
- CVE-2022-44900Critical 9.1
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows…
Affected: fixed in 0.20.1; fixed in 0.20.1.
Fixed in 0.20.1 (released Nov 1, 2022, 35 days before disclosure).
The latest release, 1.1.4, is not affected.