PyPI/emmett CVE-2026-39847: high 7.5, EPSS 0.50%

Emmett has a path traversal in internal assets handler

Action: Upgrade emmett to 2.8.1 or later.

pip install emmett==2.8.1

Affected

Fixed versions

Sources

• osv: GHSA-pr46-2v3c-5356
• https://github.com/emmett-framework/emmett/security/advisories/GHSA-pr46-2v3c-5356
• https://nvd.nist.gov/vuln/detail/CVE-2026-39847
• https://github.com/emmett-framework/emmett
• https://github.com/pypa/advisory-database/tree/main/vulns/emmett/PYSEC-2026-59.yaml

CVE-2026-39847 · published 2026-04-08T00:18:46Z · modified 2026-06-06T00:30:08.754262586Z · JSON