A vulnerability in icloudpd versions 1.17.3 up to but not including 1.33.0 allows leakage of .netrc credentials due to a URL parsing issue in the Requests library prior to version 2.32.4. This can expose sensitive credentials to third parties when processing maliciously crafted URLs. The issue is fixed in icloudpd version 1.33.0.