{"action":"Upgrade vantage6-node to 4.0.0 or later.","affected":[{"fixed":"4.0.0","introduced":"0"}],"component":"vantage6-node","cve_ids":["CVE-2023-28635"],"ecosystem":"PyPI","epss":0.00504,"exploited":false,"fixed_versions":["4.0.0"],"ghsa_id":"GHSA-7x94-6g2m-3hp2","id":"tcs_01M5KGJTPK7CFC2TK95CJX9A4T","modified_at":"2026-07-07T17:57:23.136099527Z","published_at":"2023-10-11T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-198","https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400","https://github.com/vantage6/vantage6/security/advisories/GHSA-7x94-6g2m-3hp2","https://github.com/vantage6/vantage6/pull/744"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2023-198","url":"https://osv.dev/vulnerability/PYSEC-2023-198"}],"summary":"vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with int"}