PyPI/tuf CVE-2021-41131: high 7.5, EPSS 1.45%

Client metadata path-traversal

Action: Upgrade tuf to 0.19.0 or later.

pip install tuf==0.19.0

Affected

Fixed versions

Sources

• osv: GHSA-wjw6-2cqr-j4qr
• https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr
• https://nvd.nist.gov/vuln/detail/CVE-2021-41131
• https://github.com/theupdateframework/python-tuf/issues/1527
• https://github.com/theupdateframework/python-tuf/commit/4ad7ae48fda594b640139c3b7eae21ed5155a102
• https://github.com/pypa/advisory-database/tree/main/vulns/tuf/PYSEC-2021-376.yaml
• https://github.com/theupdateframework/python-tuf

CVE-2021-41131 · published 2021-10-19T20:14:36Z · modified 2026-07-08T06:27:19.270753446Z · JSON