{"action":"Upgrade cleo to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"cleo","cve_ids":["CVE-2022-42966"],"ecosystem":"PyPI","epss":0.00992,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-2p9h-ccw7-33gf","id":"tcs_01M5KGHWBMNM6AY2FJWHG0VQ9B","modified_at":"2026-06-10T17:00:44.332510647Z","published_at":"2022-11-09T20:15:10Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43178","https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/","https://github.com/advisories/GHSA-2p9h-ccw7-33gf"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2022-43178","url":"https://osv.dev/vulnerability/PYSEC-2022-43178"}],"summary":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method"}