PyPI/flyto-core CVE-2026-67429: critical 10, EPSS 0.57%

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Action: Upgrade flyto-core to 2.26.7 or later.

pip install flyto-core==2.26.7

Affected

Fixed versions

Sources

• osv: GHSA-2956-977x-2w3r
• https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r
• https://nvd.nist.gov/vuln/detail/CVE-2026-67429
• https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc
• https://github.com/flytohub/flyto-core
• https://github.com/flytohub/flyto-core/releases/tag/v2.26.6

CVE-2026-67429 · published 2026-07-30T14:46:43Z · modified 2026-08-04T14:40:56.807170949Z · JSON