Threats affecting pkg:brew/python-lsp-server

Black, a code formatting tool, had a vulnerability where the cache file name was constructed using the unsanitized value of the --python-cell-magics option. This allowed an attacker controlling this option to write cache files to arbitrary file system locations. The issue is fixed in Black version 26.3.1.

A memory leak vulnerability exists in the UltraJSON (ujson) library versions 5.4.0 through 5.11.0 when parsing large integers outside the range [-2^63, 2^64 - 1]. This flaw can be triggered by any service using ujson to parse untrusted JSON inputs, potentially leading to denial of service (DoS). The leak involves accumulating copies of the string representation of large integers plus a null byte, regardless of whether parsing succeeds or fails. The issue is fixed in ujson version 5.12.0. No workarounds other than upgrading are available.

CVE-2026-32875 is a vulnerability in the UltraJSON (ujson) library used by python-lsp-server where integer overflow or underflow in handling the 'indent' parameter during JSON serialization can cause a segmentation fault (crash) or an infinite loop. This occurs when the product of the indent value and the nested depth exceeds the 32-bit integer limit or when a large negative indent is used. The issue can lead to denial of service. The vulnerability affects python-lsp-server versions >=1.6.0 and <1.14.0_1. A patch is available in ujson 5.12.0 that fixes the overflow and caps the indent value.

A memory leak vulnerability exists in UltraJSON (ujson) when using ujson.dump() to write JSON to a file-like object that raises an exception during the write operation. The leak occurs because the serialized JSON string object is not properly decremented, causing memory to grow linearly with each failed write. This affects applications that serialize data using ujson.dump() to potentially attacker-controlled file-like objects that can fail. The issue is fixed in UltraJSON version 5.12.1. A workaround is to replace ujson.dump() with file.write(ujson.dumps(obj)), which avoids the leak.

Pallets Click versions 8.3.2 and below contain a command injection vulnerability in the click.edit() function. This flaw allows attackers to execute arbitrary operating system commands from an unprivileged account. A security update addressing this issue is available. The vulnerability has been rated with medium severity. There are no known exploits in the wild at this time.

This update for python-black fixes the following issues: - CVE-2026-31900: a malicious pyproject.toml edit can lead to arbitrary code execution (bsc#1259546). - CVE-2026-32274: arbitrary file writes from unsanitized user input in cache file name (bsc#1259608).