{"action":"Upgrade scancodeio to 32.5.1 or later.","affected":[{"fixed":"32.5.1","introduced":"0"}],"component":"scancodeio","cve_ids":["CVE-2023-39523"],"ecosystem":"PyPI","epss":0.02922,"exploited":false,"fixed_versions":["32.5.1"],"ghsa_id":"GHSA-2ggp-cmvm-f62f","id":"tcs_01M5KGWCAXHG8MRC8136EPT68B","modified_at":"2026-07-07T17:47:37.712622767Z","published_at":"2026-07-07T11:45:21.905903Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1904","https://github.com/nexB/scancode.io/security/advisories/GHSA-2ggp-cmvm-f62f","https://nvd.nist.gov/vuln/detail/CVE-2023-39523","https://github.com/nexB/scancode.io/commit/07ec0de1964b14bf085a1c9a27ece2b61ab6105c","https://github.com/nexB/scancode.io","https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185","https://github.com/nexB/scancode.io/releases/tag/v32.5.1","https://pypi.org/project/scancodeio","https://github.com/advisories/GHSA-2ggp-cmvm-f62f"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-1904","url":"https://osv.dev/vulnerability/PYSEC-2026-1904"}],"summary":"ScanCode.io command injection in docker image fetch process"}