{"action":"Upgrade plone-app-portlets to 5.0.8 or later.","affected":[{"fixed":"5.0.8","introduced":"5.0.0"},{"fixed":"6.0.4","introduced":"6.0.0"},{"fixed":"7.0.2","introduced":"7.0.0"}],"component":"plone-app-portlets","cve_ids":["CVE-2026-57149"],"ecosystem":"PyPI","epss":0.00638,"exploited":false,"fixed_versions":["5.0.8","6.0.4","7.0.2"],"ghsa_id":"GHSA-rr49-f9g6-c9r5","id":"tcs_01M5KHA52ESP86VBMMV0G5HX07","modified_at":"2026-10-01T17:45:15.992001624Z","published_at":"2026-10-01T16:38:38.269267Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4138","https://github.com/plone/plone.app.portlets/security/advisories/GHSA-rr49-f9g6-c9r5","https://nvd.nist.gov/vuln/detail/CVE-2026-57149","https://github.com/plone/plone.app.portlets/commit/1d9cacacfad9ed08b890dadc6e75741e295dc151","https://github.com/plone/plone.app.portlets/commit/8a0641dc4054a2b13834bba00c67cd9a2fd189e1","https://github.com/plone/plone.app.portlets/commit/fb979f01b57dd2fc06c90ee6577eb5eb285da8f1","https://github.com/plone/plone.app.portlets","https://github.com/plone/plone.app.portlets/releases/tag/5.0.8","https://github.com/plone/plone.app.portlets/releases/tag/6.0.4","https://github.com/plone/plone.app.portlets/releases/tag/7.0.2","https://pypi.org/project/plone-app-portlets","https://github.com/advisories/GHSA-rr49-f9g6-c9r5"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"PYSEC-2026-4138","url":"https://osv.dev/vulnerability/PYSEC-2026-4138"}],"summary":"plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection"}