PyPI/headroom-ai CVE-2026-71416: high 8.8, EPSS 0.17%

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Action: Upgrade headroom-ai to 0.35.0 or later.

pip install headroom-ai==0.35.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4220
• https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf
• https://nvd.nist.gov/vuln/detail/CVE-2026-71416
• https://github.com/headroomlabs-ai/headroom/pull/1481
• https://github.com/headroomlabs-ai/headroom/commit/c632023cc1ec61d15f8f8e86efe3b54d51604a64
• https://github.com/headroomlabs-ai/headroom
• https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0
• https://pypi.org/project/headroom-ai
• https://github.com/advisories/GHSA-h46j-26q3-rggf

CVE-2026-71416 · published 2026-10-15T10:22:43.962847Z · modified 2026-10-15T14:45:04.405810362Z · JSON