CVE-2026-96620 is a critical vulnerability in the anthropics claude-agent-sdk-python prior to version 0.2.121. The issue arises from improper input validation of the resume option passed to the Claude CLI, allowing an attacker to inject CLI flags such as --mcp-config. This can lead to arbitrary command execution at CLI startup, bypassing SDK permission controls. The vulnerability is fixed in version 0.2.121.
ClickMigrate versions prior to 1.0.3 contain a path traversal vulnerability in the 'revision' command's '-m' argument. This flaw allows an attacker who can control the migration name to cause the tool to write a .sql file outside the intended migrations directory. Exploitation requires the ability to influence the migration name, such as via insecure automation or CI/CD pipelines. The issue has been fixed in version 1.0.3 by sanitizing the migration name input. Users should upgrade to 1.0.3 or later or restrict access to trusted users and validate migration names if immediate upgrade is not possible.
The pyyi package on PyPI is a malicious package that impersonates the Python interpreter and executes remote code supplied by a command-and-control server. It registers console commands named after Python executables (e.g., python3.7) that shadow legitimate interpreters and send system information to an obfuscated server. The package fetches, decodes, decompresses, and executes arbitrary Python code in memory without any integrity checks. It also includes a fake Python REPL that captures single-token inputs as passwords and sends them to the attacker. This combination enables remote code execution and credential theft on affected systems.
The fromthehotel-poems PyPI package version 0.1.0 includes a function getdaily() that fetches and executes remote Python code from an external server without verification. This allows whoever controls the server or can tamper with the response to execute arbitrary code with the full privileges of the calling process. The package is identified as malicious, with intent to exploit large language model agents by hiding remote code execution within its API.
The PyPI package 'proxyrobika' version 0.1.0 contains malicious code designed for automated file exfiltration. This package is part of a campaign targeting Android devices with clear malicious intent, specifically infostealing activities.
A vulnerability in JupyterLab versions 4.5.7 through 4.6.3 and related applications allows a user to mistakenly trust a different document than the one they clicked a command button in. This occurs because the trust prompt marks whichever document is current when the user responds, not necessarily the document containing the clicked button. Trusted documents run commands without further prompts, potentially allowing untrusted documents to execute commands without explicit user confirmation. The issue affects Markdown files and notebooks and can persist across sessions for notebooks due to saving the trusted state to disk. Patches are available in JupyterLab versions 4.6.4 and 4.5.11 and related dependent applications. Workarounds include disabling command linker or choosing "Run Once" instead of "Trust".
tinytag versions 2.0.0 up to but not including 2.3.0 contain a vulnerability where parsing certain crafted M4A files with a zero-sized sub-atom in the `----` atom causes an infinite loop. This results in a denial-of-service condition for applications using tinytag to read such files. The issue is fixed in version 2.3.0. No workarounds exist other than upgrading.
The getpubip package on PyPI contains malicious code that executes an obfuscated payload during import. This payload downloads and runs an infostealer that exfiltrates browser data. The malicious code is hidden using string reversal, base64 decoding, and zlib decompression, making it difficult to detect. The package falsely advertises itself as a simple tool to retrieve the host's public IP address. Any user importing or running the package executes the concealed malicious code without further action.
The py-worm package on PyPI contains malicious code in its agentaix module that downloads and executes a mutable remote Python script without user visibility on Windows. This remote script acts as a remote access trojan (RAT), enabling persistence via an HKCU Run registry entry, polling a command server for instructions, and supporting file upload, download, deletion, and command execution. Versions 0.1.0, 2.0.0, and 2.0.1 of py-worm are affected. The remote payload is mutable, meaning its exact behavior can change over time. This package is classified as malware due to its clear intent to exfiltrate files, maintain persistence, and execute remote commands.
The saeka package on PyPI is identified as malicious software designed to perform mass credit card checking by abusing legitimate online retail services. It is part of a campaign with clear malicious intent, involving the unauthorized use of third-party APIs to validate stolen credit card data.
Pipecat-ai pipecat versions from 0.0.98 up to but not including 1.6.0 include a development runner exposing unauthenticated endpoints for creating bot sessions and Daily rooms. These endpoints are bound to localhost by default and intended only for local development. Exploitation requires deliberate exposure of the runner to untrusted networks. Version 1.6.0 adds warnings and documentation directing users to authenticated or managed production deployments but does not change endpoint behavior.
CVE-2026-59951 is a medium severity vulnerability in the modelcontextprotocol python-sdk affecting versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1. The issue involves uncontrolled resource consumption due to a Streamable HTTP server in stateful mode that never reclaims session state, allowing unlimited sessions to accumulate and consume memory. This can lead to server memory growth without bound until a restart occurs. The vulnerability is fixed in versions 1.30.0 and 2.2.0, which introduce session idle timeouts, maximum session limits, and proper session cleanup.
The fontcase package on PyPI versions 0.1.0, 0.1.1, and 0.1.2 contains malicious code that downloads and executes an infostealer during import. This malicious behavior includes exfiltration of browser data and credentials, and uses a Telegram bot for communication. There is no information about an available patch or fix.
The sysdiagd package on PyPI is a malicious package disguised as a system monitoring tool. It functions as a Discord bot infostealer that exfiltrates credentials, browser data, files, and records audio, screenshots, and video. The malicious code requires bot credentials to operate and is not functional without them. The campaign associated with this package demonstrates clear malicious intent, including spyware-like behavior and persistence mechanisms.
CVE-2026-104250 is a stored cross-site scripting (XSS) vulnerability in the unstructured library prior to version 0.24.1. When unstructured parses untrusted HTML documents and outputs them as HTML, it fails to escape malicious markup such as event handlers (e.g., onerror, onmouseover) and javascript: URLs. This allows embedded scripts to execute automatically in a viewer's browser when the output is rendered. The vulnerability affects the to_html() function and related HTML output paths. Exploitation can occur without user interaction, leading to information disclosure and potential privileged actions in ingestion pipelines where untrusted documents are reviewed in a web UI.
The npp-ml package on PyPI falsely claims to provide a Notepad++ distribution but instead delivers ADExplorer, an Active Directory analysis tool. This package is identified as malicious due to its deceptive nature and intent. The affected versions are 0.1.7, 0.1.8, and 0.1.9. There is no CVSS score available for this threat.
CVE-2026-104102 is a path traversal vulnerability in the FTP and FTPS server components of copyparty before version 1.20.19. It allows uploading files to any directory writable by the copyparty process when FTP or FTPS is explicitly enabled. The vulnerability does not allow reading or overwriting existing files, and filenames have randomized suffixes. It cannot be used to execute code directly via copyparty. The main risk is that uploaded files might affect other software on the same system if that software executes files in writable directories.
The minecraftaccfinder package published on PyPI in multiple versions was a malicious package designed to steal credentials and session data from the victim's machine. It exfiltrated browser-stored logins and session cookies, collected the machine's public IP address and account identifiers, and sent this data to a hard-coded webhook. The package also installed persistent malware including a remote access trojan (RAT), keylogger, screenshot capture, and credential theft targeting multiple services such as Gmail, Roblox, Discord, and Minecraft. The package has been removed from PyPI.
The PyPI package 'agent-vx' version 0.1.0 contains malicious code that installs a persistent job on the victim's machine. This allows attackers to exfiltrate files and execute remote commands, effectively functioning as a remote access trojan (RAT). The package is designed for persistence and unauthorized remote control.
The pafer package on PyPI contains malicious code that loads and executes a disguised pickle file, leading to automatic execution of embedded malicious code. This code establishes persistence on the victim's system via a PTH file, downloads additional payloads, and functions as a remote access trojan (RAT) enabling remote code execution and data exfiltration. The malicious behavior is intentionally embedded in a dependency of the main package webreader.