{"action":"Upgrade tensorzero to 2026.6.0 or later.","affected":[{"fixed":"2026.6.0","introduced":"0"}],"component":"tensorzero","cve_ids":["CVE-2026-54457"],"ecosystem":"PyPI","epss":0.00402,"exploited":false,"fixed_versions":["2026.6.0"],"ghsa_id":"GHSA-824w-x939-6cmc","id":"tcs_01M5KH5Y3EK59NPV80KJK3PBC8","modified_at":"2026-07-23T15:00:23.851798535Z","published_at":"2026-07-23T11:41:45.645277Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3541","https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc","https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8","https://github.com/tensorzero/tensorzero","https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0","https://pypi.org/project/tensorzero","https://github.com/advisories/GHSA-824w-x939-6cmc","https://nvd.nist.gov/vuln/detail/CVE-2026-54457"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"PYSEC-2026-3541","url":"https://osv.dev/vulnerability/PYSEC-2026-3541"}],"summary":"TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint"}