PyPI/uni2ts CVE-2026-22584: critical 9.8, EPSS 0.44%

Salesforce Uni2TS has a Code Injection vulnerability

Action: Upgrade uni2ts to 2.0.0 or later.

pip install uni2ts==2.0.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-557
• https://nvd.nist.gov/vuln/detail/CVE-2026-22584
• https://github.com/SalesforceAIResearch/uni2ts/pull/218
• https://github.com/SalesforceAIResearch/uni2ts/commit/7f2d51dd729de018f0f22504f39a8475c6fed1c4
• https://github.com/SalesforceAIResearch/uni2ts
• https://github.com/SalesforceAIResearch/uni2ts/releases/tag/2.0.0
• https://help.salesforce.com/s/articleView?id=005239354&type=1
• https://pypi.org/project/uni2ts
• https://github.com/advisories/GHSA-7x99-8x99-xc54

CVE-2026-22584 · published 2026-06-29T11:50:52.030793Z · modified 2026-07-13T16:15:34.586289954Z · JSON