{"action":"Upgrade pyo3 to 0.28.2 or later.","affected":[{"fixed":"0.28.2","introduced":"0.28.0"}],"component":"pyo3","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.28.2"],"ghsa_id":"GHSA-47qc-857f-7w7f","id":"tcs_01M5KESDF7DHEMWQ5DW2AWR550","modified_at":"2026-02-23T07:26:19.729428Z","published_at":"2026-02-19T20:25:46Z","references":["https://osv.dev/vulnerability/GHSA-47qc-857f-7w7f","https://github.com/PyO3/pyo3/pull/5807#issuecomment-3913251784","https://github.com/PyO3/pyo3/commit/75abd8602896b350fd8c778e52e0a74b4644ccca","https://github.com/PyO3/pyo3","https://github.com/PyO3/pyo3/releases/tag/v0.28.2","https://rustsec.org/advisories/RUSTSEC-2026-0013.html"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-47qc-857f-7w7f","url":"https://osv.dev/vulnerability/GHSA-47qc-857f-7w7f"}],"summary":"PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature"}