PyPI/vantage6 CVE-2023-41881: low 3.7, EPSS 0.35%

vantage6 does not properly delete linked resources when deleting a collaboration

Action: Upgrade vantage6 to 4.0.0 or later.

pip install vantage6==4.0.0

Affected

Fixed versions

Sources

• osv: GHSA-rf54-7qrr-96j6
• https://github.com/vantage6/vantage6/security/advisories/GHSA-rf54-7qrr-96j6
• https://nvd.nist.gov/vuln/detail/CVE-2023-41881
• https://github.com/vantage6/vantage6/pull/748
• https://github.com/vantage6/vantage6/commit/cce9538f8b70e814c080dd0ae43b297f3af8a732
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-200.yaml
• https://github.com/vantage6/vantage6
• https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400

CVE-2023-41881 · published 2023-10-16T14:31:39Z · modified 2026-09-10T03:49:24.763224817Z · JSON