Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

CVE-2024-56327

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-47h8-jmp3-9f28

pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in the reference Go implementation of age https://github.com/FiloSottile/age, see advisory GHSA-32gq-x56h-299c https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c. Thanks to ⬡-49016 for reporting this issue.

gitlab/pypi/pyrage/CVE-2024-56327

pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in the reference Go implementation of age https://github.com/FiloSottile/age, see advisory GHSA-32gq-x56h-299c https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c. Thanks to ⬡-49016 for reporting this issue.

pypa/pyrage/PYSEC-2026-1839

pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in the reference Go implementation of age https://github.com/FiloSottile/age, see advisory GHSA-32gq-x56h-299c https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c. Thanks to ⬡-49016 for reporting this issue.

pysec/PYSEC-2026-1839

pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in the reference Go implementation of age https://github.com/FiloSottile/age, see advisory GHSA-32gq-x56h-299c https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c. Thanks to ⬡-49016 for reporting this issue.