{"action":"Upgrade scitokens to 1.9.7 or later.","affected":[{"fixed":"1.9.7","introduced":"0"}],"component":"scitokens","cve_ids":["CVE-2026-32727"],"ecosystem":"PyPI","epss":0.00525,"exploited":false,"fixed_versions":["1.9.7"],"ghsa_id":"GHSA-3x2w-63fp-3qvw","id":"tcs_01M5KGYGE4PRE0G8KWV2QN1THE","modified_at":"2026-07-13T07:15:42.375575025Z","published_at":"2026-03-31T03:15:57.340Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2277","https://github.com/scitokens/scitokens/releases/tag/v1.9.7","https://github.com/scitokens/scitokens/pull/230","https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9","https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2277","url":"https://osv.dev/vulnerability/PYSEC-2026-2277"}],"summary":"SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope c"}