{"action":"Upgrade pydantic-settings to 2.14.2 or later.","affected":[{"fixed":"2.14.2","introduced":"2.12.0"}],"component":"pydantic-settings","cve_ids":["CVE-2026-58203"],"ecosystem":"PyPI","epss":0.00185,"exploited":false,"fixed_versions":["2.14.2"],"ghsa_id":"GHSA-4xgf-cpjx-pc3j","id":"tcs_01M5KEZF20WPV3G31E268QAZPZ","modified_at":"2026-09-10T03:50:48.282428168Z","published_at":"2026-06-19T22:10:42Z","references":["https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j","https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j","https://github.com/pydantic/pydantic-settings"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-4xgf-cpjx-pc3j","url":"https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j"}],"summary":"pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size"}