{"action":"Upgrade scancodeio to 32.5.1 or later.","affected":[{"fixed":"32.5.1","introduced":"0"}],"component":"scancodeio","cve_ids":["CVE-2023-39523"],"ecosystem":"PyPI","epss":0.02922,"exploited":false,"fixed_versions":["32.5.1"],"ghsa_id":"GHSA-2ggp-cmvm-f62f","id":"tcs_01M5KESK0XFSDP6T3T5EPTJ3FN","modified_at":"2026-09-10T03:50:08.700430387Z","published_at":"2023-08-09T14:41:23Z","references":["https://osv.dev/vulnerability/GHSA-2ggp-cmvm-f62f","https://github.com/nexB/scancode.io/security/advisories/GHSA-2ggp-cmvm-f62f","https://nvd.nist.gov/vuln/detail/CVE-2023-39523","https://github.com/nexB/scancode.io/commit/07ec0de1964b14bf085a1c9a27ece2b61ab6105c","https://github.com/nexB/scancode.io","https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185","https://github.com/nexB/scancode.io/releases/tag/v32.5.1"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-2ggp-cmvm-f62f","url":"https://osv.dev/vulnerability/GHSA-2ggp-cmvm-f62f"}],"summary":"ScanCode.io command injection in docker image fetch process"}