Vulnerabilidades em pypa
27 resultadosAnálise Vexday
PyPA apresenta 6 vulnerabilidades documentadas sem exploração ativa registrada (KEV: 0), com risco moderado concentrado em directory traversal (CWE-22). Uma vulnerabilidade foi publicada nos últimos 90 dias, indicando atividade recente no ecossistema, embora nenhuma tenha alcançado nível crítico de severidade.
CVE-2022-21668HIGHPipenv's requirements.txt parsing allows malicious index url in commentsEPSS 3.9%CVE-2024-6345HIGHRemote Code Execution in pypa/setuptoolsEPSS 1.9%CVE-2025-47273HIGHsetuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WriteEPSS 1.6%CVE-2026-59890MEDIUMsetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+EPSS 0.4%CVE-2026-24049HIGHwheel Allows Arbitrary File Permission Modification via Path TraversalEPSS 0.4%CVE-2026-113726HIGHvirtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTEPSS 0.3%CVE-2026-113717LOWvirtualenv: Pip seeding with download omits wheel digest verificationEPSS 0.3%CVE-2026-113722HIGHvirtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxEPSS 0.3%CVE-2026-115586HIGHvirtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)EPSS 0.3%CVE-2026-113776HIGHvirtualenv activation scripts run code from a path that contains a placeholder nameEPSS 0.3%CVE-2026-113725HIGHvirtualenv bash activate runs commands from an environment name with a backslash before $EPSS 0.3%CVE-2026-113714LOWvirtualenv: Downloaded wheel selection and caching precede verificationEPSS 0.2%CVE-2026-113723HIGHvirtualenv: Bash prompt values can change meaning under older compatibility modesEPSS 0.2%CVE-2026-113718HIGHvirtualenv: Xonsh activation literals depend on the script decoding codecEPSS 0.2%CVE-2026-113715LOWvirtualenv: Venv configuration readback can reinterpret path boundariesEPSS 0.2%CVE-2026-113732HIGHvirtualenv activate.fish runs commands from a path or prompt with a backslash before a quoteEPSS 0.2%CVE-2026-102937HIGHvirtualenv: Command injection via --prompt in activate.bat (batch activator)EPSS 0.2%CVE-2026-113713MEDIUMvirtualenv: Temporary app-data can leave dangling seed package linksEPSS 0.2%CVE-2026-113719MEDIUMvirtualenv: Seed replacement does not contain metadata deletion pathsEPSS 0.2%CVE-2026-113724MEDIUMvirtualenv: Deletion recovery can change a symlink target's modeEPSS 0.2%