{"action":"Upgrade unoconv to 0.9.0 or later.","affected":[{"fixed":"0.9.0","introduced":"0"}],"component":"unoconv","cve_ids":["CVE-2019-17400"],"ecosystem":"PyPI","epss":0.02158,"exploited":false,"fixed_versions":["0.9.0"],"ghsa_id":"GHSA-27p5-7cw6-m45h","id":"tcs_01M5KG90MD5VCQZPXNQ70SR61X","modified_at":"2023-11-08T04:01:23.639213Z","published_at":"2019-10-21T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-213","https://github.com/unoconv/unoconv/pull/510","https://buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions/","https://github.com/advisories/GHSA-27p5-7cw6-m45h"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-213","url":"https://osv.dev/vulnerability/PYSEC-2019-213"}],"summary":"The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion."}