Threats affecting pkg:pypi/engineer-your-data

CVE-2026-7214 is a path traversal vulnerability in the eghuzefa engineer-your-data project versions up to 0.1.3. It affects several functions in src/server.py that handle file operations, allowing remote attackers to manipulate the WORKSPACE_PATH argument to access unauthorized filesystem locations. The vulnerability has a medium severity with a CVSS score of 6.9. Although an exploit is publicly available, there is no vendor response or official patch at this time.