{"action":"Upgrade netron to 9.1.3 or later.","affected":[{"fixed":"9.1.3","introduced":"0"}],"component":"netron","cve_ids":["CVE-2026-79719"],"ecosystem":"PyPI","epss":0.00264,"exploited":false,"fixed_versions":["9.1.3"],"id":"tcs_01M5KH96ZPWY4CCS62MHT4Z7ZZ","modified_at":"2026-09-30T09:15:02.791869865Z","published_at":"2026-08-27T17:20:48.900Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4002","https://github.com/lutzroeder/netron/commit/cd14bad8c9132b1aaf1d197fe61925575f194f00","https://www.hiddenlayer.com/sai-security-advisory/2026-08-netron"],"severity":{"label":"medium","score":5},"sources":[{"source":"osv","source_id":"PYSEC-2026-4002","url":"https://osv.dev/vulnerability/PYSEC-2026-4002"}],"summary":"Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote"}