{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.0"}],"component":"greykite","cve_ids":["CVE-2024-28425"],"ecosystem":"PyPI","epss":0.00561,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGMWKAZ4VMM6250W71JN8V","modified_at":"2026-05-21T15:00:13.746122211Z","published_at":"2024-03-14T19:15:50.980Z","references":["https://osv.dev/vulnerability/PYSEC-2024-276","https://github.com/bayuncao/vul-cve-17"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2024-276","url":"https://osv.dev/vulnerability/PYSEC-2024-276"}],"summary":"greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code v"}