{"action":"Upgrade h2o to 3.46.0.1 or later.","affected":[{"fixed":"3.46.0.1","introduced":"0"}],"component":"h2o","cve_ids":["CVE-2023-6569"],"ecosystem":"PyPI","epss":0.00721,"exploited":false,"fixed_versions":["3.46.0.1"],"ghsa_id":"GHSA-gqrq-j6pm-98c2","id":"tcs_01M5KH5P7NV22HWNDGS7RQ7F7V","modified_at":"2026-07-01T20:22:54.105066Z","published_at":"2026-06-29T11:50:44.448598Z","references":["https://osv.dev/vulnerability/PYSEC-2026-350","https://nvd.nist.gov/vuln/detail/CVE-2023-6569","https://github.com/h2oai/h2o-3/commit/e8884f5187eb81311877c5f0dd4d6d9c70f33d78","https://github.com/h2oai/h2o-3","https://huntr.com/bounties/a5d003dc-c23e-4c98-8dcf-35ba9252fa3c","https://pypi.org/project/h2o","https://github.com/advisories/GHSA-gqrq-j6pm-98c2"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-350","url":"https://osv.dev/vulnerability/PYSEC-2026-350"}],"summary":"External Control of File Name or Path in h2oai/h2o-3"}