{"action":"Upgrade ubi-reader to 0.8.5 or later.","affected":[{"fixed":"0.8.5","introduced":"0"}],"component":"ubi-reader","cve_ids":["CVE-2023-0591"],"ecosystem":"PyPI","epss":0.00394,"exploited":false,"fixed_versions":["0.8.5"],"ghsa_id":"GHSA-vp2x-3mc3-3cj4","id":"tcs_01M5KGKKHWYQWZQTDMFSAPC147","modified_at":"2026-06-10T17:02:47.934398306Z","published_at":"2023-01-31T10:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-51","https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/","https://github.com/jrspruitt/ubi_reader/pull/57","https://github.com/advisories/GHSA-vp2x-3mc3-3cj4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-51","url":"https://osv.dev/vulnerability/PYSEC-2023-51"}],"summary":"ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the pr"}