Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/syft@0.8.2b21
Typepypi
Namespace
Namesyft
Version0.8.2b21
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.9.6b1
Latest_non_vulnerable_version0.9.6b1
Affected_by_vulnerabilities
0
url VCID-y383-vztu-wqg1
vulnerability_id VCID-y383-vztu-wqg1
summary PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxing of user-submitted code. The system allows low-privileged users to submit Python functions (via @sy.syft_function()) for remote execution on the server. While a code approval mechanism exists, the submitted code undergoes no security checks for dangerous operations (e.g., file access, command execution). Once approved, the code is executed within the server process using exec() and eval() functions without proper isolation. A remote attacker can leverage this to execute arbitrary Python code on the server, leading to complete compromise of the server environment.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-31220
reference_id
reference_type
scores
0
value 0.00314
scoring_system epss
scoring_elements 0.54975
published_at 2026-06-11T12:55:00Z
1
value 0.00314
scoring_system epss
scoring_elements 0.55096
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-31220
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-31220
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-31220
2
reference_url https://www.notion.so/CVE-2026-31220-35d1e1393188814186b9e00114a8aba7
reference_id CVE-2026-31220-35d1e1393188814186b9e00114a8aba7
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-15T17:54:50Z/
url https://www.notion.so/CVE-2026-31220-35d1e1393188814186b9e00114a8aba7
3
reference_url https://github.com/advisories/GHSA-cfpg-c974-jfhq
reference_id GHSA-cfpg-c974-jfhq
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-cfpg-c974-jfhq
4
reference_url https://github.com/OpenMined/PySyft
reference_id PySyft
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-15T17:54:50Z/
url https://github.com/OpenMined/PySyft
fixed_packages
0
url pkg:pypi/syft@0.9.6b1
purl pkg:pypi/syft@0.9.6b1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/syft@0.9.6b1
aliases CVE-2026-31220, GHSA-cfpg-c974-jfhq
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y383-vztu-wqg1
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/syft@0.8.2b21