Threats tagged 'brew-jiratui-cve-2026-58203'

The pydantic-settings library's NestedSecretsSettingsSource component improperly follows symbolic links inside a configured secrets directory that point outside this directory, allowing files outside the intended secrets directory to be read into application settings. This behavior bypasses the configured maximum size limit for secrets directories, potentially leading to unintended local file reads and resource exhaustion via cyclic symlinks. The vulnerability affects applications using NestedSecretsSettingsSource with secrets_nested_subdir=True when the secrets directory contains attacker-influenced symlinks. The issue is fixed in pydantic-settings version 1.9.1_1.