{"action":"Upgrade kinto-attachment to 6.4.0 or later.","affected":[{"fixed":"6.4.0","introduced":"0"}],"component":"kinto-attachment","cve_ids":["CVE-2024-1314"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["6.4.0"],"ghsa_id":"GHSA-hvp4-vrv2-8wrq","id":"tcs_01M5KGSYDZSVYXCXF932WD7AHD","modified_at":"2026-07-07T17:46:46.048191780Z","published_at":"2026-07-07T11:45:32.451178Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1494","https://github.com/Kinto/kinto-attachment/security/advisories/GHSA-hvp4-vrv2-8wrq","https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1","https://bugzilla.mozilla.org/show_bug.cgi?id=1879034","https://github.com/Kinto/kinto-attachment","https://pypi.org/project/kinto-attachment","https://github.com/advisories/GHSA-hvp4-vrv2-8wrq","https://nvd.nist.gov/vuln/detail/CVE-2024-1314"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"PYSEC-2026-1494","url":"https://osv.dev/vulnerability/PYSEC-2026-1494"}],"summary":"Kinto Attachment's attachments can be replaced on read-only records"}