sbrunner/poetry-plugin-tweak-dependencies-version · Security
poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645
- GHSA ID
- GHSA-5qvp-pr9f-2g2v
- Severity
- medium
- Published
- Updated
- CVSS
- 4.4 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
- CVSS v3
- 4.4 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Description
Pin vulnerable version of requests library
CWEs
- CWE-377 · Insecure Temporary File
References
- https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2 ↗
- https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/security/advisories/GHSA-5qvp-pr9f-2g2v ↗
- https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/commit/54b5784d89f36cd413a8bc5032ab0a96438dcae3 ↗
- https://github.com/sbrunner/poetry-plugin-tweak-dependencies-version/releases/tag/1.5.6 ↗
- https://github.com/advisories/GHSA-5qvp-pr9f-2g2v ↗