PyPI/tinytag CVE-2026-104266: medium 6.5
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
Action: Upgrade tinytag to 2.3.0 or later.
pip install tinytag==2.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.3.0 | - |
Fixed versions
| 2.3.0 |
Sources
- osv: GHSA-24cc-9352-h2pg
- https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg
- https://nvd.nist.gov/vuln/detail/CVE-2026-104266
- https://github.com/tinytag/tinytag/pull/326
- https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e
- https://github.com/tinytag/tinytag
- https://github.com/tinytag/tinytag/releases/tag/2.3.0
CVE-2026-104266 · published · modified · JSON