CVE-2026-58203
1 advisory.
PyPI/pydantic-settings CVE-2026-58203: medium 5.3
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
Action: Upgrade pydantic-settings to 2.14.2 or later.
pip install pydantic-settings==2.14.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.12.0 | 2.14.2 | - |
Fixed versions
| 2.14.2 |
Sources
- osv: GHSA-4xgf-cpjx-pc3j
- https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j
- https://github.com/pydantic/pydantic-settings
CVE-2026-58203 · published · modified · JSON