{"action":"Upgrade emmett to 2.8.1 or later.","affected":[{"fixed":"2.8.1","introduced":"2.5.0"}],"component":"emmett","cve_ids":["CVE-2026-39847"],"ecosystem":"PyPI","epss":0.00495,"exploited":false,"fixed_versions":["2.8.1"],"ghsa_id":"GHSA-pr46-2v3c-5356","id":"tcs_01M5KHCA4GN40EEPYJM55G5TH4","modified_at":"2026-05-20T09:18:59.901003Z","published_at":"2026-04-07T22:16:23.793Z","references":["https://osv.dev/vulnerability/PYSEC-2026-59","https://github.com/emmett-framework/emmett/security/advisories/GHSA-pr46-2v3c-5356"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-59","url":"https://osv.dev/vulnerability/PYSEC-2026-59"}],"summary":"Emmett is a full-stack Python web framework designed with simplicity. From 2.5.0 to before 2.8.1, the RSGI static handler for Emmett's internal assets (/__emmett__ paths) is vulnerable to path travers"}