psf vulnerabilities

Products

• requests 4
• black 3
• psf-requests 1
• psf/requests 1

Latest psf CVEs

Newest publication first

1. CVE-2026-114134 Black: GitHub Action installs unvalidated required-version from pyproject.toml

   Published 2026-11-05

   High·CVSS 8.7 EPSS 0.40%

   Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull reques...

2. CVE-2026-25645 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

   Published 2026-03-25

   Medium·CVSS 5.5 EPSS 0.19%

   Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extract_zipped_paths() utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validat...

3. CVE-2026-32274 Black: Arbitrary file writes from unsanitized user input in cache file name

   Published 2026-03-12

   High·CVSS 8.7 EPSS 0.69%

   Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without san...

4. CVE-2026-31900 Black's vulnerable version parsing leads to RCE in GitHub Action

   Published 2026-03-11

   High·CVSS 8.7 EPSS 0.52%

   Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.to...

5. CVE-2024-47081 Requests vulnerable to .netrc credentials leak via malicious URLs

   Published 2025-06-09

   Medium·CVSS 5.3 EPSS 1.0%

   Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc...

6. CVE-2024-1682 Unclaimed S3 Bucket Reference in psf/requests Documentation

   Published 2024-11-14

   Medium·CVSS 4.3 EPSS 0.42%

   An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss...

7. CVE-2024-35195 Requests `Session` object does not verify requests after making first request with verify=False

   Published 2024-05-20

   Medium·CVSS 5.6 EPSS 0.34%

   Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to t...

8. CVE-2023-32681 Unintended leak of Proxy-Authorization header in requests

   Published 2023-05-26

   Medium·CVSS 6.1 EPSS 3.0%

   Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use rebuild_proxies to reattach the Proxy-Authorization header to requests. For HTTP co...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.