Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/topydo@0.13
Typepypi
Namespace
Nametopydo
Version0.13
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
0
url VCID-r4hv-hkz1-p7bz
vulnerability_id VCID-r4hv-hkz1-p7bz
summary topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a7c2cdc76f055c3841523 that can result in Injection of arbitrary bytes to the terminal, including terminal escape code sequences. This attack appear to be exploitable via The victim must open a todo.txt with at least one specially crafted line..
references
0
reference_url https://github.com/advisories/GHSA-h6h9-pphv-m266
reference_id
reference_type
scores
url https://github.com/advisories/GHSA-h6h9-pphv-m266
1
reference_url https://github.com/bram85/topydo
reference_id
reference_type
scores
url https://github.com/bram85/topydo
2
reference_url https://github.com/bram85/topydo/blob/master/topydo/lib/ListFormat.py#L292
reference_id
reference_type
scores
url https://github.com/bram85/topydo/blob/master/topydo/lib/ListFormat.py#L292
3
reference_url https://github.com/bram85/topydo/issues/240
reference_id
reference_type
scores
url https://github.com/bram85/topydo/issues/240
4
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/topydo/PYSEC-2018-76.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/topydo/PYSEC-2018-76.yaml
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-1000523
reference_id CVE-2018-1000523
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2018-1000523
fixed_packages
aliases CVE-2018-1000523, GHSA-h6h9-pphv-m266, PYSEC-2018-76
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-r4hv-hkz1-p7bz
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/topydo@0.13