Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/upsonic@0.68.1a1765105855
Typepypi
Namespace
Nameupsonic
Version0.68.1a1765105855
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.72.0
Latest_non_vulnerable_version0.72.0
Affected_by_vulnerabilities
0
url VCID-jzvs-fw8h-vyfa
vulnerability_id VCID-jzvs-fw8h-vyfa
summary 
Upsonic: remote code execution vulnerability in its MCP server/task creation functionality
Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands (npm, npx) accept argument flags that enable execution of arbitrary OS commands. Maliciously crafted MCP tasks may lead to remote code execution with the privileges of the Upsonic process. In version 0.72.0 Upsonic added a warning about using Stdio servers being able to execute commands directly on the machine.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-30625
reference_id
reference_type
scores
0
value 0.00343
scoring_system epss
scoring_elements 0.57193
published_at 2026-06-05T12:55:00Z
1
value 0.00343
scoring_system epss
scoring_elements 0.57189
published_at 2026-06-07T12:55:00Z
2
value 0.00343
scoring_system epss
scoring_elements 0.57201
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-30625
1
reference_url https://github.com/Upsonic/Upsonic
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/Upsonic/Upsonic
2
reference_url https://github.com/Upsonic/Upsonic/commit/855053fce0662227d9246268ff4a0844b481a305
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-04-16T13:53:33Z/
url https://github.com/Upsonic/Upsonic/commit/855053fce0662227d9246268ff4a0844b481a305
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-30625
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-30625
4
reference_url https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem
5
reference_url https://github.com/advisories/GHSA-cw73-5f7h-m4gv
reference_id GHSA-cw73-5f7h-m4gv
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-cw73-5f7h-m4gv
6
reference_url https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/
reference_id mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-04-16T13:53:33Z/
url https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/
fixed_packages
0
url pkg:pypi/upsonic@0.72.0
purl pkg:pypi/upsonic@0.72.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/upsonic@0.72.0
aliases CVE-2026-30625, GHSA-cw73-5f7h-m4gv
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jzvs-fw8h-vyfa
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/upsonic@0.68.1a1765105855