PYSEC-2025-5
PYSEC-2025-5 · Exfiltrates user cookies to hardcoded server endpoint during normal operations
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Published in 2020, the autodzee package is a Python library that bypasses Deezer API restrictions to download music. The package was found to exfiltrate user data to a hardcoded server, which could be used for malicious purposes.
- Published
- Updated
Stack: python
Affected products and versions
browsercmdhbt2 PyPI
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://inspector.pypi.io/project/browsercmdhbt2/0.92/packages/7e/29/415779aabb5f53eee7911e62e564a5ddaaf98d01a404feecb5b733e8b861/browsercmdhbt2-0.92-py3-none-any.whl/browsercmd/main/google.py#line.15
- https://inspector.pypi.io/project/browsercmdhbt2/0.92/packages/7e/29/415779aabb5f53eee7911e62e564a5ddaaf98d01a404feecb5b733e8b861/browsercmdhbt2-0.92-py3-none-any.whl/browsercmd/main/google.py#line.69
- https://osv.dev/vulnerability/PYSEC-2025-5