PyPI/pycsw CVE-2016-8640: critical 9.1, EPSS 2.31%

SQL Injection in pycsw

Action: Upgrade pycsw to 1.8.6 or later.

pip install pycsw==2.0.2

pip install pycsw==1.8.6

pip install pycsw==1.10.5

Affected

Fixed versions

Sources

• osv: GHSA-hg4c-rgvm-964g
• https://nvd.nist.gov/vuln/detail/CVE-2016-8640
• https://github.com/geopython/pycsw/pull/474/files
• https://github.com/geopython/pycsw/commit/522873e5ce48bb9cbd4e7e8168ca881ce709c222
• https://github.com/geopython/pycsw/commit/69546e13527c82e4f9191769215490381ad511b2
• https://github.com/geopython/pycsw/commit/daaf09b4b920708a415be3c7f446739661ba3753
• https://github.com/advisories/GHSA-hg4c-rgvm-964g
• https://github.com/geopython/pycsw
• https://github.com/pypa/advisory-database/tree/main/vulns/pycsw/PYSEC-2018-98.yaml
• https://patch-diff.githubusercontent.com/raw/geopython/pycsw/pull/474.patch
• http://seclists.org/oss-sec/2016/q4/406

CVE-2016-8640 · published 2018-08-15T20:02:53Z · modified 2026-06-09T13:00:02Z · JSON