{"action":"Upgrade saleor to 3.14.61 or later.","affected":[{"fixed":"3.14.61","introduced":"3.14.56"},{"fixed":"3.15.37","introduced":"3.15.31"},{"fixed":"3.16.34","introduced":"3.16.27"},{"fixed":"3.17.32","introduced":"3.17.25"},{"fixed":"3.18.28","introduced":"3.18.19"},{"fixed":"3.19.15","introduced":"3.19.5"}],"component":"saleor","cve_ids":["CVE-2024-29888"],"ecosystem":"PyPI","epss":0.00534,"exploited":false,"fixed_versions":["3.14.61","3.15.37","3.16.34","3.17.32","3.18.28","3.19.15"],"ghsa_id":"GHSA-mrj3-f2h4-7w45","id":"tcs_01M5KFRMTY3P04M1EF11CFNYAZ","modified_at":"2026-07-28T01:30:31.774890050Z","published_at":"2024-03-28T17:52:17Z","references":["https://osv.dev/vulnerability/GHSA-mrj3-f2h4-7w45","https://github.com/saleor/saleor/security/advisories/GHSA-mrj3-f2h4-7w45","https://nvd.nist.gov/vuln/detail/CVE-2024-29888","https://github.com/saleor/saleor/pull/15697","https://github.com/saleor/saleor/pull/15694","https://github.com/saleor/saleor/commit/47cedfd7d6524d79bdb04708edcdbb235874de6b","https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26","https://github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4","https://github.com/saleor/saleor/commit/d8ba545c16ad3153febc5b5be8fd2ef75da9fc95","https://github.com/saleor/saleor/commit/dccc2c842b4e2e09470929c80f07dc137e439182","https://github.com/saleor/saleor/commit/ef003c76a304c89ddb2dc65b7f1d5b3b2ba1c640","https://github.com/saleor/saleor/commit/39abb0f4e4fe6503f81bfbb871227e4f70bcdd5c","https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761","https://github.com/saleor/saleor/releases/tag/3.14.61","https://github.com/saleor/saleor/releases/tag/3.15.37","https://github.com/saleor/saleor/releases/tag/3.16.34","https://github.com/saleor/saleor/releases/tag/3.17.32","https://github.com/saleor/saleor/releases/tag/3.18.28","https://github.com/saleor/saleor/releases/tag/3.19.15","https://github.com/saleor/saleor","https://github.com/pypa/advisory-database/tree/main/vulns/saleor/PYSEC-2026-1890.yaml"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-mrj3-f2h4-7w45","url":"https://osv.dev/vulnerability/GHSA-mrj3-f2h4-7w45"}],"summary":"Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method"}