{"action":"Upgrade tinytag to 2.3.0 or later.","affected":[{"fixed":"2.3.0","introduced":"2.0.0"}],"component":"tinytag","cve_ids":["CVE-2026-104266"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["2.3.0"],"ghsa_id":"GHSA-24cc-9352-h2pg","id":"tcs_01M5JHG4RZ29CEJ0R6449N3M7M","modified_at":"2026-10-15T20:30:05.136549303Z","published_at":"2026-10-15T20:16:47Z","references":["https://osv.dev/vulnerability/GHSA-24cc-9352-h2pg","https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg","https://nvd.nist.gov/vuln/detail/CVE-2026-104266","https://github.com/tinytag/tinytag/pull/326","https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e","https://github.com/tinytag/tinytag","https://github.com/tinytag/tinytag/releases/tag/2.3.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-24cc-9352-h2pg","url":"https://osv.dev/vulnerability/GHSA-24cc-9352-h2pg"}],"summary":"tinytag: Infinite loop when parsing certain M4A files containing invalid atoms"}