Threat Intelligence Database

The Requests library's utility function extract_zipped_paths() uses predictable filenames when extracting zip archive contents to the system temporary directory. If a file with the same name already exists, it is reused without validation, allowing a local attacker with write access to the temp directory to substitute a malicious file. Standard usage of the Requests library is not affected; only direct calls to extract_zipped_paths() are vulnerable. The issue is fixed in Requests version 2.33.0 by extracting files to a non-deterministic location. Alternatively, setting TMPDIR to a directory with restricted write access can mitigate the risk.

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.