Threats affecting pkg:github/vulnerability-lookup/vulnerability-lookup

CVE-2026-123660 affects vulnerability-lookup versions 5.5.1 up to but not including 6.4.1. A signed-in user can craft webhook notification payload templates that cause excessive memory allocation during string formatting, leading to potential denial of service. The vulnerability arises because format specifiers in placeholders are passed unchecked to Python's string formatting, allowing very large memory allocations. Version 6.4.1 fixes this by capping format specifier numbers, limiting rendered template size, and restricting template nesting depth.