{"action":"Upgrade openmed to 1.5.2 or later.","affected":[{"fixed":"1.5.2","introduced":"0"}],"component":"openmed","cve_ids":["CVE-2026-47117"],"ecosystem":"PyPI","epss":0.00915,"exploited":false,"fixed_versions":["1.5.2"],"ghsa_id":"GHSA-m3v4-v5gx-7wf5","id":"tcs_01M5KH1YS5QJ7VJMEQP3BD4HZ3","modified_at":"2026-07-13T16:32:33.806674335Z","published_at":"2026-07-13T15:46:14.064755Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2852","https://nvd.nist.gov/vuln/detail/CVE-2026-47117","https://github.com/maziyarpanahi/openmed/pull/59","https://github.com/maziyarpanahi/openmed/commit/98724f65df98d7518b9006e6356740aa36c2f224","https://github.com/maziyarpanahi/openmed/releases/tag/v1.5.2","https://www.vulncheck.com/advisories/openmed-remote-code-execution-via-pii-model-loading","https://pypi.org/project/openmed","https://github.com/advisories/GHSA-m3v4-v5gx-7wf5"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2852","url":"https://osv.dev/vulnerability/PYSEC-2026-2852"}],"summary":"OpenMed vulnerable to remote code injection through privacy-filter model loading path"}