Everything NetSec Observer has reported about Python: 4 stories, newest first. Part of our Vulnerabilities coverage.
A high-severity flaw in Astral uv versions before 0.8.22 lets attackers write files outside the intended directory via crafted symlinks in source distributions.
A crafted FlashPix file can crash or control Python applications using Pillow versions prior to 13.0.0 by overflowing memory buffers during image decoding.
A flaw in Pillow versions prior to 13.0.0 allows zero-width images to trigger memory errors and crashes via morphology operations.
Unvalidated resume tokens in the Python SDK allow attackers to inject CLI flags, executing arbitrary commands outside security boundaries in versions before 0.2.121.