# Security Audit Report — salaah-mcp - **Report ID:** `79542a0f-1134-4ff9-aee0-c47537b3b4b8` - **Generated:** 2026-07-22T00:28:38.182245+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Unsafe (composite) **Security score:** 49.35 | Scanner | Badge | | --- | --- | | agent-audit-kit | Verified | | agentshield | unavailable | | bearer | Verified | | cisco-skill-scanner | Verified | | nerlo-behavioral | Verified | | nerlo-install-instruction | Verified | | osv-scanner | Unsafe | | trivy | Unsafe | | Severity | Findings | | --- | --- | | critical | 0 | | high | 61 | | medium | 33 | | low | 12 | salaah-mcp is NOT recommended for integration: the scan surfaced 0 critical and 61 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering. ## 2. Source Provenance - **Repository:** https://github.com/yusufk/salaah-mcp - **Commit scanned:** `unknown` - **License:** unknown - **Maintainer:** unknown - **Version:** 0.1.0 ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — unavailable / n/a No findings. ### cisco-skill-scanner (v2.0.11) — Verified / 95.5 - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[low] Python bytecode cache directory detected** — __pycache__ directory found at app/models/__pycache__/ containing 2 bytecode file(s). Pre-compiled bytecode should not be distributed in skill packages. (/repo/app/models/__pycache__:None) ### agent-audit-kit (v0.3.26) — Verified / 98.0 - **[low] MCP server repo missing SECURITY.md or security_contact** — A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a 'security_contact' entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel. (SECURITY.md:None) ### bearer (v2.0.2) — Verified / 100.0 No findings. ### nerlo-behavioral (v0.1.0) — Verified / 100.0 No findings. ### nerlo-install-instruction (v0.1.0) — Verified / 100.0 No findings. ### trivy (v0.71.0) — Unsafe / 0.0 - **[medium] fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file** — fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2. (uv.lock:None) - **[high] SQL injection vulnerability in geopandas before v.1.1.2 allows an atta ...** — SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()' function being used to write GeoDataFrames to a PostgreSQL database. (uv.lock:None) - **[medium] python-idna: idna: Denial of Service via specially crafted long inputs** — Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as '"\u0660" * N' or '"\u30fb" * N + "\u6f22"' utilize the 'valid_contexto' function prior to length rejection, and for high values of 'N' will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi (uv.lock:None) - **[high] mcp: MCP Server Crash via ClosedResourceError** — The MCP Python SDK, called 'mcp' on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.10.0 contai (uv.lock:None) - **[high] mcp: MCP SDK Denial of Service Vulnerability** — The MCP Python SDK, called 'mcp' on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue. (uv.lock:None) - **[high] mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK** — The MCP Python SDK, called 'mcp' on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin po (uv.lock:None) - **[high] MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal** — The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client (uv.lock:None) - **[high] MCP Python SDK: WebSocket server transport does not support Host/Origin validation** — The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1. (uv.lock:None) - **[high] python-pillow: pillow: Pillow DDS Heap Buffer Overflow** — Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0. (uv.lock:None) - **[high] pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image** — Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1. (uv.lock:None) - **[high] Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing** — Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround. (uv.lock:None) - **[high] Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing** — Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0. (uv.lock:None) - **[high] Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image** — Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] python-pillow: Pillow: Denial of Service via crafted PCF font data** — Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files** — Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] python-pillow: Pillow: Denial of Service via crafted BDF font file** — Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] python-pillow: Pillow: Denial of Service via crafted GD 2.x image file** — Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] Pillow: Pillow: Native heap out-of-bounds write** — Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] Pillow: Pillow: Denial of Service via out-of-bounds write in image processing** — Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] Pillow: Pillow: Denial of service via crafted PDF stream** — Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] Pillow: Pillow: Denial of Service via crafted JPEG2000 image** — Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0. (uv.lock:None) - **[high] Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API** — Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0. (uv.lock:None) - **[medium] Pillow: python: Pillow: Denial of Service via integer overflow in font processing** — Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0. (uv.lock:None) - **[medium] Pillow: Pillow: Denial of Service via specially crafted coordinate input** — Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0. (uv.lock:None) - **[medium] Pillow: Pillow: Denial of Service via malicious PDF processing** — Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0. (uv.lock:None) - **[medium] python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths** — Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0. (uv.lock:None) - **[medium] Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read** — Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0. (uv.lock:None) - **[low] pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer** — A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. (uv.lock:None) - **[medium] python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following** — python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, 'set_key()' and 'unset_key()' in python-dotenv follow symbolic links when rewriting '.env' files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually. (uv.lock:None) - **[high] python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability** — Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options 'UPLOAD_DIR' and 'UPLOAD_KEEP_FILENAME=True'. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using 'UPLOAD_KEEP_FILENAME=True' in project configurations. (uv.lock:None) - **[high] python-multipart: python-multipart: Denial of Service via excessive multipart part headers** — Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request reje (uv.lock:None) - **[high] python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies** — Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the ne (uv.lock:None) - **[medium] python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests** — Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted 'multipart/form-data' requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary. (uv.lock:None) - **[low] multipart: Python-Multipart: Information disclosure via header parsing discrepancy** — Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 §4.2 explicitly forbid (uv.lock:None) - **[low] python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling** — Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form (uv.lock:None) - **[low] python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory** — Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31. (uv.lock:None) - **[medium] requests: Requests vulnerable to .netrc credentials leak via malicious URLs** — Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with 'trust_env=False' on one's Requests Session. (uv.lock:None) - **[medium] requests: Requests: Security bypass due to predictable temporary file creation** — Requests is a HTTP library. Prior to version 2.33.0, the 'requests.utils.extract_zipped_paths()' utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner (uv.lock:None) - **[high] starlette: Starlette DoS via Range header merging** — Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1. (uv.lock:None) - **[high] starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows** — Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas (uv.lock:None) - **[high] starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS** — Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. (uv.lock:None) - **[medium] starlette: Starlette denial-of-service** — Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_me (uv.lock:None) - **[medium] starlette: Starlette: Security restriction bypass via malformed HTTP Host header** — Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP 'Host' request header was not validated before being used to reconstruct 'request.url'. Because the routing algorithm relies on the raw HTTP path while 'request.url' is rebuilt from the 'Host' header, a malformed header could make 'request.url.path' differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on 'request.url' (rather than the raw 'scope' path) (uv.lock:None) - **[medium] starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods** — Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo (uv.lock:None) - **[low] starlette: Starlette: Information disclosure due to improper HTTP request path validation** — Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header (uv.lock:None) - **[high] urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion** — urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0. (uv.lock:None) - **[high] urllib3: urllib3 Streaming API improperly handles highly compressed data** — urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, b (uv.lock:None) - **[high] urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)** — urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP 'Content-Encoding' header (e.g., 'gzip', 'deflate', 'br', or 'zstd'). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in ve (uv.lock:None) - **[high] urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers** — urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0. (uv.lock:None) - **[medium] urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation** — urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0. (uv.lock:None) - **[medium] urllib3: urllib3 does not control redirects in browsers and Node.js** — urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodi (uv.lock:None) ### osv-scanner (v2.3.8) — Unsafe / 0.0 - **[high] PYSEC-2026-2132 — PyPI click@8.2.1** — aliases: CVE-2026-7246, GHSA-47fr-3ffg-hgmw, PYSEC-2026-2132 \| CVSS: 7.2 (/repo/uv.lock:None) - **[medium] PYSEC-2026-1389 — PyPI fonttools@4.58.1** — aliases: CVE-2025-66034, GHSA-768j-98cg-p3fv, PYSEC-2026-1389 \| CVSS: 6.3 (/repo/uv.lock:None) - **[high] PYSEC-2026-62 — PyPI geopandas@1.0.1** — aliases: CVE-2025-69662, GHSA-6497-prx7-gpmq, PYSEC-2026-62 \| CVSS: 8.6 (/repo/uv.lock:None) - **[medium] PYSEC-2026-215 — PyPI idna@3.10** — aliases: CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215 \| CVSS: 6.9 (/repo/uv.lock:None) - **[high] PYSEC-2026-1616 — PyPI mcp@1.9.2** — aliases: CVE-2025-53366, GHSA-3qhf-m339-9g5v, PYSEC-2026-1616 \| CVSS: 8.7 (/repo/uv.lock:None) - **[high] PYSEC-2026-1617 — PyPI mcp@1.9.2** — aliases: CVE-2025-66416, GHSA-9h52-p55h-vw2f, PYSEC-2026-1617 \| CVSS: 7.6 (/repo/uv.lock:None) - **[high] PYSEC-2026-1618 — PyPI mcp@1.9.2** — aliases: CVE-2025-53365, GHSA-j975-95f5-7wqh, PYSEC-2026-1618 \| CVSS: 8.7 (/repo/uv.lock:None) - **[high] GHSA-jpw9-pfvf-9f58 — PyPI mcp@1.9.2** — aliases: CVE-2026-52869, GHSA-jpw9-pfvf-9f58 \| CVSS: 7.1 (/repo/uv.lock:None) - **[high] GHSA-vj7q-gjh5-988w — PyPI mcp@1.9.2** — aliases: CVE-2026-59950, GHSA-vj7q-gjh5-988w \| CVSS: 7.6 (/repo/uv.lock:None) - **[high] PYSEC-2025-61 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2025-48379, CVE-2025-48379, GHSA-xg8h-j46f-w952, PYSEC-2025-61 \| CVSS: 7.1 (/repo/uv.lock:None) - **[medium] PYSEC-2026-165 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-42308, CVE-2026-42308, GHSA-wjx4-4jcj-g98j, PYSEC-2026-165 \| CVSS: 5.5 (/repo/uv.lock:None) - **[high] PYSEC-2026-2249 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-25990, CVE-2026-25990, GHSA-cfh3-3jmp-rvhc, PYSEC-2026-2249 \| CVSS: 8.6 (/repo/uv.lock:None) - **[high] PYSEC-2026-2250 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-40192, CVE-2026-40192, GHSA-whj4-6x5x-4v2j, PYSEC-2026-2250 \| CVSS: 8.7 (/repo/uv.lock:None) - **[medium] PYSEC-2026-2251 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-42309, CVE-2026-42309, GHSA-5xmw-vc9v-4wf2, PYSEC-2026-2251 \| CVSS: 5.5 (/repo/uv.lock:None) - **[high] PYSEC-2026-2252 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-42311, CVE-2026-42311, GHSA-pwv6-vv43-88gr, PYSEC-2026-2252 \| CVSS: 8.6 (/repo/uv.lock:None) - **[high] PYSEC-2026-2253 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-54059, CVE-2026-54059, GHSA-8v84-f9pq-wr9x, PYSEC-2026-2253 \| CVSS: 7.5 (/repo/uv.lock:None) - **[high] PYSEC-2026-2254 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-54060, CVE-2026-54060, GHSA-5x94-69rx-g8h2, PYSEC-2026-2254 \| CVSS: 7.5 (/repo/uv.lock:None) - **[high] PYSEC-2026-2255 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-55379, CVE-2026-55379, GHSA-45hq-cxwh-f6vc, PYSEC-2026-2255 \| CVSS: 7.5 (/repo/uv.lock:None) - **[high] PYSEC-2026-2256 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-55380, CVE-2026-55380, GHSA-phj9-mv4w-65pm, PYSEC-2026-2256 \| CVSS: 7.5 (/repo/uv.lock:None) - **[medium] PYSEC-2026-2257 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-55798, CVE-2026-55798, GHSA-4x4j-2g7c-83w6, PYSEC-2026-2257 \| CVSS: 4.5 (/repo/uv.lock:None) - **[medium] PYSEC-2026-2874 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-42310, CVE-2026-42310, GHSA-r73j-pqj5-w3x7, PYSEC-2026-2874 \| CVSS: 5.5 (/repo/uv.lock:None) - **[high] PYSEC-2026-3451 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-59199, CVE-2026-59199, GHSA-6r8x-57c9-28j4, PYSEC-2026-3451 \| CVSS: 7.5 (/repo/uv.lock:None) - **[high] PYSEC-2026-3453 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-59205, CVE-2026-59205, GHSA-9hw9-ch79-4vh6, PYSEC-2026-3453 \| CVSS: 7.5 (/repo/uv.lock:None) - **[high] GHSA-62p4-gmf7-7g93 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-54058, CVE-2026-54058, GHSA-62p4-gmf7-7g93 \| CVSS: 8.3 (/repo/uv.lock:None) - **[medium] GHSA-fj7v-r99m-22gq — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-59198, CVE-2026-59198, GHSA-fj7v-r99m-22gq \| CVSS: 6.5 (/repo/uv.lock:None) - **[high] GHSA-jjj6-mw9f-p565 — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-59200, CVE-2026-59200, GHSA-jjj6-mw9f-p565 \| CVSS: 7.5 (/repo/uv.lock:None) - **[high] GHSA-vjc4-5qp5-m44j — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-59204, CVE-2026-59204, GHSA-vjc4-5qp5-m44j \| CVSS: 8.7 (/repo/uv.lock:None) - **[high] GHSA-xj96-63gp-2gmr — PyPI pillow@11.2.1** — aliases: BIT-pillow-2026-59197, CVE-2026-59197, GHSA-xj96-63gp-2gmr \| CVSS: 8.2 (/repo/uv.lock:None) - **[low] PYSEC-2026-2987 — PyPI pygments@2.19.1** — aliases: CVE-2026-4539, GHSA-5239-wwwm-4pmq, PYSEC-2026-2987 \| CVSS: 3.3 (/repo/uv.lock:None) - **[medium] PYSEC-2026-2270 — PyPI python-dotenv@1.1.0** — aliases: CVE-2026-28684, GHSA-mf9w-mj56-hr94, PYSEC-2026-2270 \| CVSS: 6.6 (/repo/uv.lock:None) - **[high] PYSEC-2026-1852 — PyPI python-multipart@0.0.20** — aliases: CVE-2026-24486, GHSA-wp53-j4wj-2cfg, PYSEC-2026-1852 \| CVSS: 8.6 (/repo/uv.lock:None) - **[high] PYSEC-2026-3036 — PyPI python-multipart@0.0.20** — aliases: CVE-2026-53539, GHSA-5rvq-cxj2-64vf, PYSEC-2026-3036 \| CVSS: 7.5 (/repo/uv.lock:None) - **[low] PYSEC-2026-3037 — PyPI python-multipart@0.0.20** — aliases: CVE-2026-53538, GHSA-6jv3-5f52-599m, PYSEC-2026-3037 \| CVSS: 3.7 (/repo/uv.lock:None) - **[medium] PYSEC-2026-3038 — PyPI python-multipart@0.0.20** — aliases: CVE-2026-40347, GHSA-mj87-hwqh-73pj, PYSEC-2026-3038 \| CVSS: 5.3 (/repo/uv.lock:None) - **[high] PYSEC-2026-3039 — PyPI python-multipart@0.0.20** — aliases: CVE-2026-42561, GHSA-pp6c-gr5w-3c5g, PYSEC-2026-3039 \| CVSS: 7.5 (/repo/uv.lock:None) - **[low] PYSEC-2026-3040 — PyPI python-multipart@0.0.20** — aliases: CVE-2026-53540, GHSA-v9pg-7xvm-68hf, PYSEC-2026-3040 \| CVSS: 3.7 (/repo/uv.lock:None) - **[low] PYSEC-2026-3041 — PyPI python-multipart@0.0.20** — aliases: CVE-2026-53537, GHSA-vffw-93wf-4j4q, PYSEC-2026-3041 \| CVSS: 3.7 (/repo/uv.lock:None) - **[medium] PYSEC-2026-1872 — PyPI requests@2.32.3** — aliases: CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872 \| CVSS: 5.3 (/repo/uv.lock:None) - **[medium] PYSEC-2026-2275 — PyPI requests@2.32.3** — aliases: CVE-2026-25645, GHSA-gc5v-m9x4-r6x2, PYSEC-2026-2275 \| CVSS: 5.5 (/repo/uv.lock:None) - **[medium] PYSEC-2026-161 — PyPI starlette@0.46.2** — aliases: CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002 \| CVSS: 6.5 (/repo/uv.lock:None) - **[medium] PYSEC-2026-1941 — PyPI starlette@0.46.2** — aliases: CVE-2025-54121, GHSA-2c2j-9gv5-cj73, PYSEC-2026-1941 \| CVSS: 5.3 (/repo/uv.lock:None) - **[high] PYSEC-2026-1942 — PyPI starlette@0.46.2** — aliases: CVE-2025-62727, GHSA-7f5h-v6xp-fcq8, PYSEC-2026-1942 \| CVSS: 7.5 (/repo/uv.lock:None) - **[medium] PYSEC-2026-2280 — PyPI starlette@0.46.2** — aliases: CVE-2026-48817, GHSA-x746-7m8f-x49c, PYSEC-2026-2280 \| CVSS: 5.3 (/repo/uv.lock:None) - **[high] PYSEC-2026-2281 — PyPI starlette@0.46.2** — aliases: CVE-2026-48818, GHSA-wqp7-x3pw-xc5r, PYSEC-2026-2281 \| CVSS: 7.5 (/repo/uv.lock:None) - **[medium] PYSEC-2026-248 — PyPI starlette@0.46.2** — aliases: CVE-2026-54282, GHSA-jp82-jpqv-5vv3, PYSEC-2026-248 \| CVSS: 5.3 (/repo/uv.lock:None) - **[high] PYSEC-2026-249 — PyPI starlette@0.46.2** — aliases: CVE-2026-54283, GHSA-82w8-qh3p-5jfq, PYSEC-2026-249 \| CVSS: 7.5 (/repo/uv.lock:None) - **[high] PYSEC-2026-141 — PyPI urllib3@2.4.0** — aliases: CVE-2026-44431, GHSA-qccp-gfcp-xxvc, PYSEC-2026-141 \| CVSS: 8.2 (/repo/uv.lock:None) - **[high] PYSEC-2026-1994 — PyPI urllib3@2.4.0** — aliases: CVE-2025-66471, GHSA-2xpw-w6gg-jr37, PYSEC-2026-1994 \| CVSS: 8.9 (/repo/uv.lock:None) - **[high] PYSEC-2026-1996 — PyPI urllib3@2.4.0** — aliases: CVE-2026-21441, GHSA-38jv-5279-wg99, PYSEC-2026-1996 \| CVSS: 8.9 (/repo/uv.lock:None) - **[medium] PYSEC-2026-1997 — PyPI urllib3@2.4.0** — aliases: CVE-2025-50182, GHSA-48p4-8xcf-vxj5, PYSEC-2026-1997 \| CVSS: 5.3 (/repo/uv.lock:None) - **[high] PYSEC-2026-1998 — PyPI urllib3@2.4.0** — aliases: CVE-2025-66418, GHSA-gm62-xv2j-4w53, PYSEC-2026-1998 \| CVSS: 8.9 (/repo/uv.lock:None) - **[medium] PYSEC-2026-1999 — PyPI urllib3@2.4.0** — aliases: CVE-2025-50181, GHSA-pq67-6m6q-mj2v, PYSEC-2026-1999 \| CVSS: 5.3 (/repo/uv.lock:None) ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `ffc98db0-de63-48f3-908e-b28139e141a8` - **Completed:** 2026-07-21T03:47:03.002475+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:8da4f6692918e836ddba4c8ddd26562eb341283e3054981c2af54dcfba1038d5` - **AI decision log entries:** 1 - `1468be52-8fd1-47d1-b702-fa24d2b47cb8` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 1.427092960992013, "status": "not_applicable", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 95.5, "scanner_badge": "Verified", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/app/models/__pycache__", "line_number": null, "rule_identifier": "PYCACHE_FILES_DETECTED", "title": "Python bytecode cache directory detected", "description": "__pycache__ directory found at app/models/__pycache__/ containing 2 bytecode file(s). Pre-compiled bytecode should not be distributed in skill packages.", "remediation": "Remove __pycache__ directories from skill packages. Ship source code only." } ], "execution_duration_seconds": 27.81487250200007, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 2, "high": 0, "medium": 0, "critical": 0, "informational": 1 } }, "display_score": 95.5, "display_badge": "Verified" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 98.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." } ], "execution_duration_seconds": 10.274521423998522, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 15, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 1, "high": 0, "medium": 0, "critical": 0, "informational": 0 } }, "display_score": 98.0, "display_badge": "Verified" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 12.851787934996537, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 42.173903498987784, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 8, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 41.85495496800286, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 1, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66034", "title": "fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file", "description": "fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). This issue has been patched in version 4.60.2.", "remediation": "Upgrade fonttools from 4.58.1 to 4.60.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-69662", "title": "SQL injection vulnerability in geopandas before v.1.1.2 allows an atta ...", "description": "SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.", "remediation": "Upgrade geopandas from 1.0.1 to 1.1.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-45409", "title": "python-idna: idna: Denial of Service via specially crafted long inputs", "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi", "remediation": "Upgrade idna from 3.10 to 3.15 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-53365", "title": "mcp: MCP Server Crash via ClosedResourceError", "description": "The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.10.0 contai", "remediation": "Upgrade mcp from 1.9.2 to 1.10.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-53366", "title": "mcp: MCP SDK Denial of Service Vulnerability", "description": "The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.", "remediation": "Upgrade mcp from 1.9.2 to 1.9.4 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66416", "title": "mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK", "description": "The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin po", "remediation": "Upgrade mcp from 1.9.2 to 1.23.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-52869", "title": "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal", "description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client", "remediation": "Upgrade mcp from 1.9.2 to 1.27.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59950", "title": "MCP Python SDK: WebSocket server transport does not support Host/Origin validation", "description": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.", "remediation": "Upgrade mcp from 1.9.2 to 1.28.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-48379", "title": "python-pillow: pillow: Pillow DDS Heap Buffer Overflow", "description": "Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 11.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-25990", "title": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image", "description": "Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.", "remediation": "Upgrade pillow from 11.2.1 to 12.1.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-40192", "title": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing", "description": "Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.", "remediation": "Upgrade pillow from 11.2.1 to 12.2.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-42311", "title": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing", "description": "Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.2.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54058", "title": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image", "description": "Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54059", "title": "python-pillow: Pillow: Denial of Service via crafted PCF font data", "description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54060", "title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files", "description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-55379", "title": "python-pillow: Pillow: Denial of Service via crafted BDF font file", "description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-55380", "title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file", "description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59197", "title": "Pillow: Pillow: Native heap out-of-bounds write", "description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59199", "title": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing", "description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59200", "title": "Pillow: Pillow: Denial of service via crafted PDF stream", "description": "Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59204", "title": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image", "description": "Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59205", "title": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API", "description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-42308", "title": "Pillow: python: Pillow: Denial of Service via integer overflow in font processing", "description": "Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.2.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-42309", "title": "Pillow: Pillow: Denial of Service via specially crafted coordinate input", "description": "Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.2.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-42310", "title": "Pillow: Pillow: Denial of Service via malicious PDF processing", "description": "Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.2.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-55798", "title": "python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths", "description": "Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-59198", "title": "Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read", "description": "Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.", "remediation": "Upgrade pillow from 11.2.1 to 12.3.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-4539", "title": "pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer", "description": "A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", "remediation": "Upgrade pygments from 2.19.1 to 2.20.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-28684", "title": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following", "description": "python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.", "remediation": "Upgrade python-dotenv from 1.1.0 to 1.2.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-24486", "title": "python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.22 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-42561", "title": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request reje", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.27 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53539", "title": "python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the ne", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-40347", "title": "python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests", "description": "Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.26 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53537", "title": "multipart: Python-Multipart: Information disclosure via header parsing discrepancy", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 \u00a74.2 explicitly forbid", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53538", "title": "python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form ", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.30 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-53540", "title": "python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory", "description": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.", "remediation": "Upgrade python-multipart from 0.0.20 to 0.0.31 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2024-47081", "title": "requests: Requests vulnerable to .netrc credentials leak via malicious URLs", "description": "Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.", "remediation": "Upgrade requests from 2.32.3 to 2.32.4 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-25645", "title": "requests: Requests: Security bypass due to predictable temporary file creation", "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner", "remediation": "Upgrade requests from 2.32.3 to 2.33.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-62727", "title": "starlette: Starlette DoS via Range header merging", "description": "Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial\u2011of\u2011service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.", "remediation": "Upgrade starlette from 0.46.2 to 0.49.1 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48818", "title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54283", "title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS", "description": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.", "remediation": "Upgrade starlette from 0.46.2 to 1.3.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-54121", "title": "starlette: Starlette denial-of-service", "description": "Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_me", "remediation": "Upgrade starlette from 0.46.2 to 0.47.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48710", "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) ", "remediation": "Upgrade starlette from 0.46.2 to 1.0.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-48817", "title": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods", "description": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo", "remediation": "Upgrade starlette from 0.46.2 to 1.1.0 or later" }, { "tool_name": "trivy", "severity": "low", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-54282", "title": "starlette: Starlette: Information disclosure due to improper HTTP request path validation", "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header ", "remediation": "Upgrade starlette from 0.46.2 to 1.3.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66418", "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-66471", "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, b", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-21441", "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)", "description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in ve", "remediation": "Upgrade urllib3 from 2.4.0 to 2.6.3 or later" }, { "tool_name": "trivy", "severity": "high", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2026-44431", "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.7.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-50181", "title": "urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation", "description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "uv", "file_path": "uv.lock", "line_number": null, "rule_identifier": "CVE-2025-50182", "title": "urllib3: urllib3 does not control redirects in browsers and Node.js", "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodi", "remediation": "Upgrade urllib3 from 2.4.0 to 2.5.0 or later" } ], "execution_duration_seconds": 0.816571720992215, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 5, "high": 30, "medium": 16, "critical": 0, "informational": 0 }, "manifests_scanned": [ "uv.lock" ] }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2132", "title": "PYSEC-2026-2132 \u2014 PyPI click@8.2.1", "description": "aliases: CVE-2026-7246, GHSA-47fr-3ffg-hgmw, PYSEC-2026-2132 | CVSS: 7.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1389", "title": "PYSEC-2026-1389 \u2014 PyPI fonttools@4.58.1", "description": "aliases: CVE-2025-66034, GHSA-768j-98cg-p3fv, PYSEC-2026-1389 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-62", "title": "PYSEC-2026-62 \u2014 PyPI geopandas@1.0.1", "description": "aliases: CVE-2025-69662, GHSA-6497-prx7-gpmq, PYSEC-2026-62 | CVSS: 8.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-215", "title": "PYSEC-2026-215 \u2014 PyPI idna@3.10", "description": "aliases: CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1616", "title": "PYSEC-2026-1616 \u2014 PyPI mcp@1.9.2", "description": "aliases: CVE-2025-53366, GHSA-3qhf-m339-9g5v, PYSEC-2026-1616 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1617", "title": "PYSEC-2026-1617 \u2014 PyPI mcp@1.9.2", "description": "aliases: CVE-2025-66416, GHSA-9h52-p55h-vw2f, PYSEC-2026-1617 | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1618", "title": "PYSEC-2026-1618 \u2014 PyPI mcp@1.9.2", "description": "aliases: CVE-2025-53365, GHSA-j975-95f5-7wqh, PYSEC-2026-1618 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-jpw9-pfvf-9f58", "title": "GHSA-jpw9-pfvf-9f58 \u2014 PyPI mcp@1.9.2", "description": "aliases: CVE-2026-52869, GHSA-jpw9-pfvf-9f58 | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-vj7q-gjh5-988w", "title": "GHSA-vj7q-gjh5-988w \u2014 PyPI mcp@1.9.2", "description": "aliases: CVE-2026-59950, GHSA-vj7q-gjh5-988w | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2025-61", "title": "PYSEC-2025-61 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2025-48379, CVE-2025-48379, GHSA-xg8h-j46f-w952, PYSEC-2025-61 | CVSS: 7.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-165", "title": "PYSEC-2026-165 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-42308, CVE-2026-42308, GHSA-wjx4-4jcj-g98j, PYSEC-2026-165 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2249", "title": "PYSEC-2026-2249 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-25990, CVE-2026-25990, GHSA-cfh3-3jmp-rvhc, PYSEC-2026-2249 | CVSS: 8.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2250", "title": "PYSEC-2026-2250 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-40192, CVE-2026-40192, GHSA-whj4-6x5x-4v2j, PYSEC-2026-2250 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2251", "title": "PYSEC-2026-2251 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-42309, CVE-2026-42309, GHSA-5xmw-vc9v-4wf2, PYSEC-2026-2251 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2252", "title": "PYSEC-2026-2252 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-42311, CVE-2026-42311, GHSA-pwv6-vv43-88gr, PYSEC-2026-2252 | CVSS: 8.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2253", "title": "PYSEC-2026-2253 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-54059, CVE-2026-54059, GHSA-8v84-f9pq-wr9x, PYSEC-2026-2253 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2254", "title": "PYSEC-2026-2254 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-54060, CVE-2026-54060, GHSA-5x94-69rx-g8h2, PYSEC-2026-2254 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2255", "title": "PYSEC-2026-2255 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-55379, CVE-2026-55379, GHSA-45hq-cxwh-f6vc, PYSEC-2026-2255 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2256", "title": "PYSEC-2026-2256 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-55380, CVE-2026-55380, GHSA-phj9-mv4w-65pm, PYSEC-2026-2256 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2257", "title": "PYSEC-2026-2257 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-55798, CVE-2026-55798, GHSA-4x4j-2g7c-83w6, PYSEC-2026-2257 | CVSS: 4.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2874", "title": "PYSEC-2026-2874 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-42310, CVE-2026-42310, GHSA-r73j-pqj5-w3x7, PYSEC-2026-2874 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3451", "title": "PYSEC-2026-3451 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-59199, CVE-2026-59199, GHSA-6r8x-57c9-28j4, PYSEC-2026-3451 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3453", "title": "PYSEC-2026-3453 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-59205, CVE-2026-59205, GHSA-9hw9-ch79-4vh6, PYSEC-2026-3453 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-62p4-gmf7-7g93", "title": "GHSA-62p4-gmf7-7g93 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-54058, CVE-2026-54058, GHSA-62p4-gmf7-7g93 | CVSS: 8.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-fj7v-r99m-22gq", "title": "GHSA-fj7v-r99m-22gq \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-59198, CVE-2026-59198, GHSA-fj7v-r99m-22gq | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-jjj6-mw9f-p565", "title": "GHSA-jjj6-mw9f-p565 \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-59200, CVE-2026-59200, GHSA-jjj6-mw9f-p565 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-vjc4-5qp5-m44j", "title": "GHSA-vjc4-5qp5-m44j \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-59204, CVE-2026-59204, GHSA-vjc4-5qp5-m44j | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "GHSA-xj96-63gp-2gmr", "title": "GHSA-xj96-63gp-2gmr \u2014 PyPI pillow@11.2.1", "description": "aliases: BIT-pillow-2026-59197, CVE-2026-59197, GHSA-xj96-63gp-2gmr | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2987", "title": "PYSEC-2026-2987 \u2014 PyPI pygments@2.19.1", "description": "aliases: CVE-2026-4539, GHSA-5239-wwwm-4pmq, PYSEC-2026-2987 | CVSS: 3.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2270", "title": "PYSEC-2026-2270 \u2014 PyPI python-dotenv@1.1.0", "description": "aliases: CVE-2026-28684, GHSA-mf9w-mj56-hr94, PYSEC-2026-2270 | CVSS: 6.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1852", "title": "PYSEC-2026-1852 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-24486, GHSA-wp53-j4wj-2cfg, PYSEC-2026-1852 | CVSS: 8.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3036", "title": "PYSEC-2026-3036 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53539, GHSA-5rvq-cxj2-64vf, PYSEC-2026-3036 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3037", "title": "PYSEC-2026-3037 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53538, GHSA-6jv3-5f52-599m, PYSEC-2026-3037 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3038", "title": "PYSEC-2026-3038 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-40347, GHSA-mj87-hwqh-73pj, PYSEC-2026-3038 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3039", "title": "PYSEC-2026-3039 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-42561, GHSA-pp6c-gr5w-3c5g, PYSEC-2026-3039 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3040", "title": "PYSEC-2026-3040 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53540, GHSA-v9pg-7xvm-68hf, PYSEC-2026-3040 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-3041", "title": "PYSEC-2026-3041 \u2014 PyPI python-multipart@0.0.20", "description": "aliases: CVE-2026-53537, GHSA-vffw-93wf-4j4q, PYSEC-2026-3041 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1872", "title": "PYSEC-2026-1872 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2275", "title": "PYSEC-2026-2275 \u2014 PyPI requests@2.32.3", "description": "aliases: CVE-2026-25645, GHSA-gc5v-m9x4-r6x2, PYSEC-2026-2275 | CVSS: 5.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-161", "title": "PYSEC-2026-161 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002 | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1941", "title": "PYSEC-2026-1941 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-54121, GHSA-2c2j-9gv5-cj73, PYSEC-2026-1941 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1942", "title": "PYSEC-2026-1942 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2025-62727, GHSA-7f5h-v6xp-fcq8, PYSEC-2026-1942 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2280", "title": "PYSEC-2026-2280 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48817, GHSA-x746-7m8f-x49c, PYSEC-2026-2280 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-2281", "title": "PYSEC-2026-2281 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-48818, GHSA-wqp7-x3pw-xc5r, PYSEC-2026-2281 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-248", "title": "PYSEC-2026-248 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54282, GHSA-jp82-jpqv-5vv3, PYSEC-2026-248 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-249", "title": "PYSEC-2026-249 \u2014 PyPI starlette@0.46.2", "description": "aliases: CVE-2026-54283, GHSA-82w8-qh3p-5jfq, PYSEC-2026-249 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-141", "title": "PYSEC-2026-141 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-44431, GHSA-qccp-gfcp-xxvc, PYSEC-2026-141 | CVSS: 8.2", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1994", "title": "PYSEC-2026-1994 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66471, GHSA-2xpw-w6gg-jr37, PYSEC-2026-1994 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1996", "title": "PYSEC-2026-1996 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2026-21441, GHSA-38jv-5279-wg99, PYSEC-2026-1996 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1997", "title": "PYSEC-2026-1997 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50182, GHSA-48p4-8xcf-vxj5, PYSEC-2026-1997 | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1998", "title": "PYSEC-2026-1998 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-66418, GHSA-gm62-xv2j-4w53, PYSEC-2026-1998 | CVSS: 8.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "PyPI", "file_path": "/repo/uv.lock", "line_number": null, "rule_identifier": "PYSEC-2026-1999", "title": "PYSEC-2026-1999 \u2014 PyPI urllib3@2.4.0", "description": "aliases: CVE-2025-50181, GHSA-pq67-6m6q-mj2v, PYSEC-2026-1999 | CVSS: 5.3", "remediation": null } ], "execution_duration_seconds": 7.128931680999813, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "PyPI" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 4, "high": 31, "medium": 17, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/uv.lock" ], "finding_id_aliases": { "PYSEC-2025-61": [ "BIT-pillow-2025-48379", "CVE-2025-48379", "GHSA-xg8h-j46f-w952" ], "PYSEC-2026-62": [ "CVE-2025-69662", "GHSA-6497-prx7-gpmq" ], "PYSEC-2026-141": [ "CVE-2026-44431", "GHSA-qccp-gfcp-xxvc" ], "PYSEC-2026-161": [ "CVE-2026-48710", "GHSA-86qp-5c8j-p5mr", "X41-2026-002" ], "PYSEC-2026-165": [ "BIT-pillow-2026-42308", "CVE-2026-42308", "GHSA-wjx4-4jcj-g98j" ], "PYSEC-2026-215": [ "CVE-2026-45409", "GHSA-65pc-fj4g-8rjx" ], "PYSEC-2026-248": [ "CVE-2026-54282", "GHSA-jp82-jpqv-5vv3" ], "PYSEC-2026-249": [ "CVE-2026-54283", "GHSA-82w8-qh3p-5jfq" ], "PYSEC-2026-1389": [ "CVE-2025-66034", "GHSA-768j-98cg-p3fv" ], "PYSEC-2026-1616": [ "CVE-2025-53366", "GHSA-3qhf-m339-9g5v" ], "PYSEC-2026-1617": [ "CVE-2025-66416", "GHSA-9h52-p55h-vw2f" ], "PYSEC-2026-1618": [ "CVE-2025-53365", "GHSA-j975-95f5-7wqh" ], "PYSEC-2026-1852": [ "CVE-2026-24486", "GHSA-wp53-j4wj-2cfg" ], "PYSEC-2026-1872": [ "CVE-2024-47081", "GHSA-9hjg-9r4m-mvj7" ], "PYSEC-2026-1941": [ "CVE-2025-54121", "GHSA-2c2j-9gv5-cj73" ], "PYSEC-2026-1942": [ "CVE-2025-62727", "GHSA-7f5h-v6xp-fcq8" ], "PYSEC-2026-1994": [ "CVE-2025-66471", "GHSA-2xpw-w6gg-jr37" ], "PYSEC-2026-1996": [ "CVE-2026-21441", "GHSA-38jv-5279-wg99" ], "PYSEC-2026-1997": [ "CVE-2025-50182", "GHSA-48p4-8xcf-vxj5" ], "PYSEC-2026-1998": [ "CVE-2025-66418", "GHSA-gm62-xv2j-4w53" ], "PYSEC-2026-1999": [ "CVE-2025-50181", "GHSA-pq67-6m6q-mj2v" ], "PYSEC-2026-2132": [ "CVE-2026-7246", "GHSA-47fr-3ffg-hgmw" ], "PYSEC-2026-2249": [ "BIT-pillow-2026-25990", "CVE-2026-25990", "GHSA-cfh3-3jmp-rvhc" ], "PYSEC-2026-2250": [ "BIT-pillow-2026-40192", "CVE-2026-40192", "GHSA-whj4-6x5x-4v2j" ], "PYSEC-2026-2251": [ "BIT-pillow-2026-42309", "CVE-2026-42309", "GHSA-5xmw-vc9v-4wf2" ], "PYSEC-2026-2252": [ "BIT-pillow-2026-42311", "CVE-2026-42311", "GHSA-pwv6-vv43-88gr" ], "PYSEC-2026-2253": [ "BIT-pillow-2026-54059", "CVE-2026-54059", "GHSA-8v84-f9pq-wr9x" ], "PYSEC-2026-2254": [ "BIT-pillow-2026-54060", "CVE-2026-54060", "GHSA-5x94-69rx-g8h2" ], "PYSEC-2026-2255": [ "BIT-pillow-2026-55379", "CVE-2026-55379", "GHSA-45hq-cxwh-f6vc" ], "PYSEC-2026-2256": [ "BIT-pillow-2026-55380", "CVE-2026-55380", "GHSA-phj9-mv4w-65pm" ], "PYSEC-2026-2257": [ "BIT-pillow-2026-55798", "CVE-2026-55798", "GHSA-4x4j-2g7c-83w6" ], "PYSEC-2026-2270": [ "CVE-2026-28684", "GHSA-mf9w-mj56-hr94" ], "PYSEC-2026-2275": [ "CVE-2026-25645", "GHSA-gc5v-m9x4-r6x2" ], "PYSEC-2026-2280": [ "CVE-2026-48817", "GHSA-x746-7m8f-x49c" ], "PYSEC-2026-2281": [ "CVE-2026-48818", "GHSA-wqp7-x3pw-xc5r" ], "PYSEC-2026-2874": [ "BIT-pillow-2026-42310", "CVE-2026-42310", "GHSA-r73j-pqj5-w3x7" ], "PYSEC-2026-2987": [ "CVE-2026-4539", "GHSA-5239-wwwm-4pmq" ], "PYSEC-2026-3036": [ "CVE-2026-53539", "GHSA-5rvq-cxj2-64vf" ], "PYSEC-2026-3037": [ "CVE-2026-53538", "GHSA-6jv3-5f52-599m" ], "PYSEC-2026-3038": [ "CVE-2026-40347", "GHSA-mj87-hwqh-73pj" ], "PYSEC-2026-3039": [ "CVE-2026-42561", "GHSA-pp6c-gr5w-3c5g" ], "PYSEC-2026-3040": [ "CVE-2026-53540", "GHSA-v9pg-7xvm-68hf" ], "PYSEC-2026-3041": [ "CVE-2026-53537", "GHSA-vffw-93wf-4j4q" ], "PYSEC-2026-3451": [ "BIT-pillow-2026-59199", "CVE-2026-59199", "GHSA-6r8x-57c9-28j4" ], "PYSEC-2026-3453": [ "BIT-pillow-2026-59205", "CVE-2026-59205", "GHSA-9hw9-ch79-4vh6" ], "GHSA-62p4-gmf7-7g93": [ "BIT-pillow-2026-54058", "CVE-2026-54058" ], "GHSA-fj7v-r99m-22gq": [ "BIT-pillow-2026-59198", "CVE-2026-59198" ], "GHSA-jjj6-mw9f-p565": [ "BIT-pillow-2026-59200", "CVE-2026-59200" ], "GHSA-jpw9-pfvf-9f58": [ "CVE-2026-52869" ], "GHSA-vj7q-gjh5-988w": [ "CVE-2026-59950" ], "GHSA-vjc4-5qp5-m44j": [ "BIT-pillow-2026-59204", "CVE-2026-59204" ], "GHSA-xj96-63gp-2gmr": [ "BIT-pillow-2026-59197", "CVE-2026-59197" ] }, "cross_scanner_correlation": { "only_osv": [ "PYSEC-2026-2132" ], "only_trivy": [], "intersection_ids": [ "CVE-2024-47081", "CVE-2025-48379", "CVE-2025-50181", "CVE-2025-50182", "CVE-2025-53365", "CVE-2025-53366", "CVE-2025-54121", "CVE-2025-62727", "CVE-2025-66034", "CVE-2025-66416", "CVE-2025-66418", "CVE-2025-66471", "CVE-2025-69662", "CVE-2026-21441", "CVE-2026-24486", "CVE-2026-25645", "CVE-2026-25990", "CVE-2026-28684", "CVE-2026-40192", "CVE-2026-40347", "CVE-2026-42308", "CVE-2026-42309", "CVE-2026-42310", "CVE-2026-42311", "CVE-2026-42561", "CVE-2026-44431", "CVE-2026-4539", "CVE-2026-45409", "CVE-2026-48710", "CVE-2026-48817", "CVE-2026-48818", "CVE-2026-52869", "CVE-2026-53537", "CVE-2026-53538", "CVE-2026-53539", "CVE-2026-53540", "CVE-2026-54058", "CVE-2026-54059", "CVE-2026-54060", "CVE-2026-54282", "CVE-2026-54283", "CVE-2026-55379", "CVE-2026-55380", "CVE-2026-55798", "CVE-2026-59197", "CVE-2026-59198", "CVE-2026-59199", "CVE-2026-59200", "CVE-2026-59204", "CVE-2026-59205", "CVE-2026-59950" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] ```