{"action":"Upgrade parso to 0.5.0 or later.","affected":[{"fixed":"0.5.0","introduced":"0"}],"component":"parso","cve_ids":["CVE-2019-12760"],"ecosystem":"PyPI","epss":0.01534,"exploited":false,"fixed_versions":["0.5.0"],"ghsa_id":"GHSA-22mf-97vh-x8rw","id":"tcs_01M5KG8C2K90P1FZV6Q3E332CP","modified_at":"2023-11-08T04:01:06.251068Z","published_at":"2019-06-06T19:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-109","https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7","https://github.com/davidhalter/parso/issues/75","https://github.com/advisories/GHSA-22mf-97vh-x8rw"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-109","url":"https://osv.dev/vulnerability/PYSEC-2019-109"}],"summary":"** DISPUTED ** A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be wri"}