{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.1.13","last_affected":"0.1.14"}],"component":"aiocpa","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-486g-47cc-8wxf","id":"tcs_01M5KEXJNAQ2JJQW957TH6V6N7","modified_at":"2024-11-25T22:08:57Z","published_at":"2024-11-25T22:08:57Z","references":["https://osv.dev/vulnerability/GHSA-486g-47cc-8wxf","https://blog.pypi.org/posts/2024-11-25-aiocpa-attack-analysis","https://github.com/pypa/advisory-database/tree/main/vulns/aiocpa/PYSEC-2024-152.yaml","https://inspector.pypi.io/project/aiocpa/0.1.13/packages/ab/98/7343281068a2c39086d0b877219668a487508197f46e89b3f41046a4a8ba/aiocpa-0.1.13.tar.gz/aiocpa-0.1.13/cryptopay/utils/sync.py#line.44"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-486g-47cc-8wxf","url":"https://osv.dev/vulnerability/GHSA-486g-47cc-8wxf"}],"summary":"aiocpa contains credential harvesting code"}