{"action":"Upgrade distributed to 2026.1.0 or later.","affected":[{"fixed":"2026.1.0","introduced":"0"}],"component":"distributed","cve_ids":["CVE-2026-23528"],"ecosystem":"PyPI","epss":0.00233,"exploited":false,"fixed_versions":["2026.1.0"],"ghsa_id":"GHSA-c336-7962-wfj2","id":"tcs_01M5KGV3BXY1QCB3P84SBQQVCC","modified_at":"2026-05-30T18:45:05.726805491Z","published_at":"2026-01-16T17:15:54.640Z","references":["https://osv.dev/vulnerability/PYSEC-2026-169","https://github.com/dask/distributed/security/advisories/GHSA-c336-7962-wfj2","https://github.com/dask/distributed/commit/ab72092a8a938923c2bb51a2cd14ca26614827fa"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-169","url":"https://osv.dev/vulnerability/PYSEC-2026-169"}],"summary":"Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which wil"}