{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.5.0b3.dev101"}],"component":"pyload-ng","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fr26-jjhm-638c","id":"tcs_01M5KFFZK2X3KJ4R10PMJ38Y2Q","modified_at":"2026-10-09T17:15:05.166152072Z","published_at":"2026-10-09T17:08:58Z","references":["https://osv.dev/vulnerability/GHSA-fr26-jjhm-638c","https://github.com/pyload/pyload/security/advisories/GHSA-fr26-jjhm-638c","https://github.com/pyload/pyload/commit/09eec1b431b6942a1917f094f2c77bfbf5637f60","https://github.com/pyload/pyload"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-fr26-jjhm-638c","url":"https://osv.dev/vulnerability/GHSA-fr26-jjhm-638c"}],"summary":"pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)"}