PyPI/graphifyy: medium
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Action: Upgrade graphifyy to 0.9.70 or later.
pip install graphifyy==0.9.70Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.7.2 | 0.9.70 | - |
Fixed versions
| 0.9.70 |
Sources
- osv: GHSA-pcc4-rvhr-2pr8
- https://github.com/Graphify-Labs/graphify/security/advisories/GHSA-pcc4-rvhr-2pr8
- https://github.com/Graphify-Labs/graphify/commit/e1d9deed6a437f2c85458ef3c42519159f322b7b
- https://github.com/Graphify-Labs/graphify
- https://github.com/Graphify-Labs/graphify/releases/tag/v0.9.70
published · modified · JSON