{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.9.1"}],"component":"copyparty","cve_ids":["CVE-2023-41471"],"ecosystem":"PyPI","epss":0.00261,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGPCYTFCFX99HDK5RVDB8W","modified_at":"2026-07-13T07:15:20.464214268Z","published_at":"2025-08-29T19:15:32.310Z","references":["https://osv.dev/vulnerability/PYSEC-2025-240","https://github.com/9001/copyparty/releases/tag/v1.9.2","https://github.com/9001/copyparty","https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/copyparty.md"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2025-240","url":"https://osv.dev/vulnerability/PYSEC-2025-240"}],"summary":"Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKE"}