# supervisor (PyPI) vulnerabilities

2 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 4.3.0 (Aug 23, 2025): no advisory with comparable ranges affects it; 2 advisories (CVE-2019-12105, CVE-2017-11610) can't be checked against versions
- Newest unaffected release: 4.3.0 (Aug 23, 2025), the latest release, not counting 2 advisories without comparable ranges
- Weekly downloads: 2.3M
- Dependents: 190
- Releases: 40 since 3.0.0 (Jul 31, 2013)
- Registry: https://pypi.org/project/supervisor/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2019-12105: its ranges can't be placed on these versions
- CVE-2017-11610: its ranges can't be placed on these versions

## Advisories (2)

### [CVE-2019-12105](https://cve.now/CVE-2019-12105): In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service.

- Severity: Unrated
- Published: Sep 10, 2019
- Affected: fixed in 4.0.3.

### [CVE-2017-11610](https://cve.now/CVE-2017-11610): The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated…

- Severity: Unrated
- Published: Aug 23, 2017
- Affected: fixed in 3.0.1; from 3.1.0, fixed in 3.1.4; from 3.2.0, fixed in 3.2.4; from 3.3.0, fixed in 3.3.3; fixed in 3.0.1; from 3.1, fixed in 3.1.4; from 3.2, fixed in 3.2.4; from 3.3, fixed in 3.3.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/supervisor
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.