{"action":"Upgrade dash-uploader to 0.7.0a1 or later.","affected":[{"fixed":"0.7.0a1","introduced":"0.1.0"}],"component":"dash-uploader","cve_ids":["CVE-2026-38361"],"ecosystem":"PyPI","epss":0.02777,"exploited":false,"fixed_versions":["0.7.0a1"],"id":"tcs_01M5KH6V324AMZCPR4KXG0D5BV","modified_at":"2026-05-20T09:18:56.225045Z","published_at":"2026-05-08T15:16:37.120Z","references":["https://osv.dev/vulnerability/PYSEC-2026-37","https://docs.python.org/3/library/functions.html#all","https://github.com/fohrloop/dash-uploader/blob/stable/dash_uploader/httprequesthandler.py","https://libraries.io/pypi/dash-uploader","https://pepy.tech/project/dash-uploader","https://pypistats.org/packages/dash-uploader","https://github.com/fohrloop/dash-uploader/issues/153","https://github.com/fohrloop/dash-uploader","https://pypi.org/project/dash-uploader/","https://github.com/a1ohadance/CVE-2026-38361"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-37","url":"https://osv.dev/vulnerability/PYSEC-2026-37"}],"summary":"An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, dash_uploader/upload.py in the Upload funct"}