p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Python · Seite 51

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Python: 360. Davon im KEV-Katalog: 1.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Python

Sicherheitslücken: 7131

  1. CVE-2026-69247

    Hoch · CVSS 8.2EPSS 0,27%Korrektur verfügbar

    cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an

    cryptography python-cryptography cryptography python-cryptographyBetriebssysteme Python
    • Auf 46.0.5-1ubuntu2.2 aktualisieren
    • Auf 49.0.0-2 aktualisieren
    • Auf 50.0.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-69244

    Hoch · CVSS 7.1EPSS 0,53%Korrektur verfügbar

    AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.

    aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.3 aktualisieren
    • Auf 3.14.3-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-48061

    Mittel · CVSS 5.9EPSS 0,38%Korrektur verfügbar

    Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, this enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. Any application using AllowedHostsConfig is affected when deployed without a reverse proxy that

    litestar litestarPython
    • Auf 2.22.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-69243

    Mittel · CVSS 6.3EPSS 0,44%Korrektur verfügbar

    AIOHTTP: HTTP request smuggling via WebSocket upgrade

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.2 aktualisieren
    • Auf 3.14.3-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-66065

    Hoch · CVSS 8.4EPSS 0,24%Korrektur verfügbar

    Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)

    Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the neste

    ouroboros ouroboros-aiPython
    • Auf 0.42.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-47211

    Hoch · CVSS 8.4EPSS 0,19%Korrektur verfügbar

    Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

    Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability stems from Ouroboros loading the .env file from the current working directory. Execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors are accepted directly from this local .env. An attacker can include a malicious script in the repository

    ouroboros ouroboros-aiPython
    • Auf 0.39.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-18654

    Mittel · CVSS 6.9EPSS 0,46%Korrektur verfügbar

    Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

    Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.

    aws-cli awscliPython
    • Auf 1.45.28 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-69097

    Hoch · CVSS 7.3EPSS 0,27%Korrektur verfügbar

    GitPython before 3.1.53 Config Injection via Submodule Names

    GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitBetriebssysteme Python
    • Auf 3.1.44-1+deb13u1 aktualisieren
    • Auf 3.1.53 aktualisieren
    • Auf 3.1.61-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-12259

    Mittel · CVSS 5.3EPSS 0,1%Korrektur verfügbar

    Improper Input Validation in nltk/nltk

    In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.

    nltk/nltk nltk nltk nltk nltk nltk nltk nltk nltk nltk nltk nltkBetriebssysteme Python
    • Auf 3.9.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  10. CVE-2026-9856

    Hoch · CVSS 7.1EPSS 0,46%Korrektur verfügbar

    Path Traversal in huggingface/transformers

    A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker

    huggingface/transformers transformersPython
    • Auf 5.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-9335

    Mittel · CVSS 6.5EPSS 0,77%Korrektur verfügbar

    Improper Handling of HDF5 ExternalLinks in keras-team/keras

    A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads

    keras-team/keras keras keras keras keras keras kerasBetriebssysteme Python
    • Auf 3.12.3 aktualisieren
    • Auf 3.12.3, 3.15.0 aktualisieren
    • Auf 3.15.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-67326

    Hoch · CVSS 7.3EPSS 0,25%Korrektur verfügbar

    GitPython before 3.1.50 Newline Injection via config_writer section

    GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitBetriebssysteme Python
    • Auf 3.1.44-1+deb13u1 aktualisieren
    • Auf 3.1.50 aktualisieren
    • Auf 3.1.50-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-67324

    Kritisch · CVSS 9.3EPSS 0,64%Korrektur verfügbar

    GitPython 3.1.50 Authentication Bypass via Joined Short Options

    GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitBetriebssysteme Python
    • Auf 3.1.44-1+deb13u1 aktualisieren
    • Auf 3.1.51 aktualisieren
    • Auf 3.1.61-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-67323

    Hoch · CVSS 8.6EPSS 1,25%Korrektur verfügbar

    GitPython before 3.1.51 Command Injection via unguarded Git options

    GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitBetriebssysteme Python
    • Auf 3.1.44-1+deb13u1 aktualisieren
    • Auf 3.1.51 aktualisieren
    • Auf 3.1.61-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-67338

    Mittel · CVSS 5.1EPSS 0,3%Korrektur verfügbar

    JupyterLab before 4.5.9 Stored XSS via Extension Manager

    JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

    jupyterlab jupyterlab jupyterlab jupyterlab jupyterlab jupyterlabBetriebssysteme Python
    • Auf 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4 aktualisieren
    • Auf 4.5.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-67322

    Hoch · CVSS 8.7EPSS 0,33%Korrektur verfügbar

    GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

    GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitBetriebssysteme Python
    • Auf 3.1.44-1+deb13u1 aktualisieren
    • Auf 3.1.52 aktualisieren
    • Auf 3.1.61-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-67325

    Hoch · CVSS 8.7EPSS 2,21%Korrektur verfügbar

    GitPython before 3.1.51 Command Injection via option prefix abbreviation

    GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitBetriebssysteme Python
    • Auf 3.1.44-1+deb13u1 aktualisieren
    • Auf 3.1.51 aktualisieren
    • Auf 3.1.61-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-54785

    Mittel · CVSS 6.2EPSS 0,19%Korrektur verfügbar

    gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

    gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.

    gemini-bridge gemini-bridgePython
    • Auf 1.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-68770

    Kritisch · CVSS 9.3EPSS 0,91%Korrektur verfügbar

    sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

    sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execut

    sentence-transformers sentence-transformersPython
    • Auf 5.6.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-53502

    Hoch · CVSS 8.7EPSS 0,52%Korrektur verfügbar

    Thumbor has path traversal via post-validation URL decoding bypass in file_loader

    Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input. This issue is fixed in 7.8.0.

    thumbor thumbor thumbor thumborBetriebssysteme Python
    • Auf 7.8.0 aktualisieren
    • Auf 7.8.0-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →