Threats affecting pkg:brew/aws-google-auth

A memory exhaustion vulnerability exists in soupsieve's CSS selector parser used by Beautiful Soup 4. The parser allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker to cause denial of service by exhausting heap memory. A crafted selector string of about 500 KB can trigger allocation of approximately 244 MB of memory, leading to potential process termination or system degradation. This affects applications that compile user-supplied CSS selectors without limits. The issue is fixed in version 0.0.38_23.

CVE-2026-22701 is a Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability in the SoftFileLock class of the filelock package. It allows a local attacker with permission to create symlinks to exploit a race window between permission checking and file creation, potentially causing lock operations to fail or operate on unintended files. This can lead to silent lock failures, denial of service, and resource serialization issues. The vulnerability has been patched by adding the O_NOFOLLOW flag to prevent symlink following during lock file creation. Users should upgrade to version 0.0.38_18 or later and consider alternative locking mechanisms in critical environments.

A TOCTOU race condition in the filelock library allows local attackers to exploit a timing gap during lock file creation to perform symlink attacks that truncate arbitrary user files. This affects Unix, Linux, macOS, and Windows systems and cascades to dependent libraries such as virtualenv, PyTorch, poetry, and tox. The vulnerability is fixed in filelock version 3.20.1 by adding protections against symlink following. Users should upgrade immediately to mitigate the risk.

A URL parsing vulnerability in aws-google-auth versions from 0.0.31 up to but not including 0.0.38_13 can cause leakage of .netrc credentials to third parties when processing certain malicious URLs. This issue is fixed in version 0.0.38_13. The vulnerability has a medium severity with a CVSS score of 5.3.