{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.3.3"}],"component":"aliyundrive-webdav","cve_ids":["CVE-2024-29640"],"ecosystem":"PyPI","epss":0.01179,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-73v2-rxqp-7q4f","id":"tcs_01M5KGQNN2KCQPN1E7DGB7MMRD","modified_at":"2026-07-07T17:46:11.024043778Z","published_at":"2026-07-07T11:45:37.035521Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1114","https://nvd.nist.gov/vuln/detail/CVE-2024-29640","https://github.com/lakemoon602/vuln/blob/main/detail.md","https://github.com/messense/aliyundrive-webdav","https://github.com/messense/aliyundrive-webdav/blob/main/openwrt/luci-app-aliyundrive-webdav/luasrc/controller/aliyundrive-webdav.lua","http://aliyundrive-webdav.com","https://pypi.org/project/aliyundrive-webdav","https://github.com/advisories/GHSA-73v2-rxqp-7q4f"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-1114","url":"https://osv.dev/vulnerability/PYSEC-2026-1114"}],"summary":"aliyundrive-webdav vulnerable to Command Injection"}