{"action":"Upgrade opencanary to 0.9.4 or later.","affected":[{"fixed":"0.9.4","introduced":"0"}],"component":"opencanary","cve_ids":["CVE-2024-48911"],"ecosystem":"PyPI","epss":0.00223,"exploited":false,"fixed_versions":["0.9.4"],"ghsa_id":"GHSA-pf5v-pqfv-x8jj","id":"tcs_01M5KGMQA6C7WWJ914CZ4QPRCD","modified_at":"2025-05-16T14:56:49.762799Z","published_at":"2024-10-14T21:15:12Z","references":["https://osv.dev/vulnerability/PYSEC-2024-248","https://github.com/thinkst/opencanary/security/advisories/GHSA-pf5v-pqfv-x8jj","https://github.com/thinkst/opencanary/commit/2c11575b1a3dd8b0df26a879ba856c0aa350c049","https://github.com/thinkst/opencanary/releases/tag/v0.9.4"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2024-248","url":"https://osv.dev/vulnerability/PYSEC-2024-248"}],"summary":"OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the"}