{"action":"Upgrade pyxdg to 0.26 or later.","affected":[{"fixed":"0.26","introduced":"0"}],"component":"pyxdg","cve_ids":["CVE-2019-12761"],"ecosystem":"PyPI","epss":0.02105,"exploited":false,"fixed_versions":["0.26"],"ghsa_id":"GHSA-r6v3-hpxj-r8rv","id":"tcs_01M5KG8XF4W5GRDBK728X3TXEN","modified_at":"2023-11-08T04:01:06.312371Z","published_at":"2019-06-06T19:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-199","https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562","https://gist.github.com/dhondta/b45cd41f4186110a354dc7272916feba","https://lists.debian.org/debian-lts-announce/2019/06/msg00006.html","https://github.com/advisories/GHSA-r6v3-hpxj-r8rv"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-199","url":"https://osv.dev/vulnerability/PYSEC-2019-199"}],"summary":"A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.pars"}