Vulnerability-Lookup

CVE-2026-42301 (GCVE-0-2026-42301)

Vulnerability from cvelistv5 – Published: 2026-05-09 03:59 – Updated: 2026-05-11 17:34

Title

Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec

Summary

pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/befeleme/pyp2spec/security/adv…	x_refsource_CONFIRM
https://github.com/befeleme/pyp2spec/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
befeleme	pyp2spec	Affected: < 0.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42301",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T17:33:41.998650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T17:34:43.929Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyp2spec",
          "vendor": "befeleme",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-09T03:59:34.741Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw"
        },
        {
          "name": "https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-r35x-v8p8-xvhw",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Input Validation leading to Improper Control of Generation of Code (\u0027Code Injection\u0027) in pyp2spec"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42301",
    "datePublished": "2026-05-09T03:59:34.741Z",
    "dateReserved": "2026-04-26T12:13:55.552Z",
    "dateUpdated": "2026-05-11T17:34:43.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42301",
      "date": "2026-08-10",
      "epss": "0.00198",
      "percentile": "0.09744"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42301\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-09T04:16:25.923\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1.\"},{\"lang\":\"es\",\"value\":\"pyp2spec genera un archivo spec RPM de Fedora funcional para proyectos Python. Antes de la versi\u00f3n 0.14.1, pyp2spec escrib\u00eda los metadatos del paquete PyPI (por ejemplo, el campo \u0027summary\u0027) en el archivo spec generado sin escapar las directivas de macro RPM. Cuando un empaquetador ejecuta rpmbuild, esas directivas se eval\u00faan, por lo que un paquete malicioso puede ejecutar comandos arbitrarios en la m\u00e1quina de compilaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 0.14.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"befeleme\",\"product\":\"pyp2spec\",\"versions\":[{\"version\":\"\u003c 0.14.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-11T17:33:41.998650Z\",\"id\":\"CVE-2026-42301\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"references\":[{\"url\":\"https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-05-15T16:04:57+00:00",
      "cve": "CVE-2026-42301",
      "id": "CVE-2026-42301",
      "initial_release_date": "2026-05-09T03:59:34.741000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "pyp2spec: python: pyp2spec: Arbitrary command execution via unescaped RPM macro directives",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42301.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42301\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-11T17:33:41.998650Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-11T17:34:30.548Z\"}}], \"cna\": {\"title\": \"Improper Input Validation leading to Improper Control of Generation of Code (\u0027Code Injection\u0027) in pyp2spec\", \"source\": {\"advisory\": \"GHSA-r35x-v8p8-xvhw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"befeleme\", \"product\": \"pyp2spec\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.14.1\"}]}], \"references\": [{\"url\": \"https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw\", \"name\": \"https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1\", \"name\": \"https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-09T03:59:34.741Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42301\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T17:34:43.929Z\", \"dateReserved\": \"2026-04-26T12:13:55.552Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-09T03:59:34.741Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42301

Vulnerability from fkie_nvd - Published: 2026-05-09 04:16 - Updated: 2026-06-17 10:47

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1
	security-advisories@github.com	https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pyp2spec",
          "vendor": "befeleme",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.14.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1."
    }
  ],
  "id": "CVE-2026-42301",
  "lastModified": "2026-06-17T10:47:39.450",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42301",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-11T17:33:41.998650Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-09T04:16:25.923",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-R35X-V8P8-XVHW

Vulnerability from github – Published: 2026-05-04 20:14 – Updated: 2026-05-13 13:39

Summary

pyp2spec is Vulnerable to Code Injection

Details

Impact

pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine.

The macro evaluates during spec parsing, not only during the build step. Any rpm tool touching the generated spec triggers execution, rpmbuild -bs, rpmbuild --nobuild, rpm -q --specfile, so the victim doesn't need to commit to a full build before getting compromised. The realistic attack path is typosquatting or targeting a package known to be under Fedora review rather than drive-by publishing. Fedora packagers hold dist-git SSH keys, Koji build credentials, and Bodhi update credentials, so compromise of one packager's workstation enables committing malicious source to dist-git and riding it through the normal build pipeline to end users.

Patches

Patched in 0.14.1.

Workarounds

None

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pyp2spec"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42301"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T20:14:38Z",
    "nvd_published_at": "2026-05-09T04:16:25Z",
    "severity": "HIGH"
  },
  "details": "### Impact\npyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine.\n\nThe macro evaluates during spec parsing, not only during the build step. Any rpm tool touching the generated spec triggers execution, `rpmbuild -bs`, `rpmbuild --nobuild`, `rpm -q --specfile`, so the victim doesn\u0027t need to commit to a full build before getting compromised. The realistic attack path is typosquatting or targeting a package known to be under Fedora review rather than drive-by publishing. Fedora packagers hold dist-git SSH keys, Koji build credentials, and Bodhi update credentials, so compromise of one packager\u0027s workstation enables committing malicious source to dist-git and riding it through the normal build pipeline to end users.\n\n### Patches\nPatched in 0.14.1.\n\n### Workarounds\nNone",
  "id": "GHSA-r35x-v8p8-xvhw",
  "modified": "2026-05-13T13:39:32Z",
  "published": "2026-05-04T20:14:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42301"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/befeleme/pyp2spec"
    },
    {
      "type": "WEB",
      "url": "https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyp2spec is Vulnerable to Code Injection"
}

PYSEC-2026-3003

Vulnerability from pysec - Published: 2026-07-13 15:02 - Updated: 2026-07-13 16:05

Details

Impact

Patches

Patched in 0.14.1.

Workarounds

None

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Impacted products

Name	purl
pyp2spec	pkg:pypi/pyp2spec

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pyp2spec",
        "purl": "pkg:pypi/pyp2spec"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.10.0",
        "0.11.0",
        "0.11.1",
        "0.12.0",
        "0.12.1",
        "0.12.2",
        "0.13.0",
        "0.2.0",
        "0.3.0",
        "0.3.1",
        "0.3.2",
        "0.3.3",
        "0.4.0",
        "0.5.0",
        "0.5.0a1",
        "0.6.0",
        "0.6.1",
        "0.7.0",
        "0.8.0",
        "0.9.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42301",
    "GHSA-r35x-v8p8-xvhw"
  ],
  "details": "### Impact\npyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine.\n\nThe macro evaluates during spec parsing, not only during the build step. Any rpm tool touching the generated spec triggers execution, `rpmbuild -bs`, `rpmbuild --nobuild`, `rpm -q --specfile`, so the victim doesn\u0027t need to commit to a full build before getting compromised. The realistic attack path is typosquatting or targeting a package known to be under Fedora review rather than drive-by publishing. Fedora packagers hold dist-git SSH keys, Koji build credentials, and Bodhi update credentials, so compromise of one packager\u0027s workstation enables committing malicious source to dist-git and riding it through the normal build pipeline to end users.\n\n### Patches\nPatched in 0.14.1.\n\n### Workarounds\nNone",
  "id": "PYSEC-2026-3003",
  "modified": "2026-07-13T16:05:55.877278Z",
  "published": "2026-07-13T15:02:56.968679Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/befeleme/pyp2spec/security/advisories/GHSA-r35x-v8p8-xvhw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42301"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/befeleme/pyp2spec"
    },
    {
      "type": "WEB",
      "url": "https://github.com/befeleme/pyp2spec/releases/tag/v0.14.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/pyp2spec"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-r35x-v8p8-xvhw"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyp2spec is Vulnerable to Code Injection"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-42301 (GCVE-0-2026-42301)

FKIE_CVE-2026-42301

GHSA-R35X-V8P8-XVHW

Impact

Patches

Workarounds

PYSEC-2026-3003

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature