Threats tagged 'brew-semgrep-cve-2026-58203'

The pydantic-settings library's NestedSecretsSettingsSource component improperly follows symbolic links inside a configured secrets directory that point outside this directory, allowing local files outside the intended secrets directory to be read into application settings. This behavior also bypasses the configured maximum size limit for secrets loading, potentially leading to excessive resource consumption. The vulnerability requires the ability to place symlinks inside the secrets directory and is not remotely exploitable on its own. It affects versions from 1.143.0 up to but not including 1.168.0. A fix is available in version 1.168.0.