---
title: "Critical PyPI advisories (page 4)"
url: https://erroneo.us/security/ecosystem/pypi/4/
description: "All 451 critical GitHub-reviewed PyPI security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 4 of 5."
type: ecosystem
section: "Security Digest"
date_modified: 2025-06-02
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical PyPI advisories (page 4)

- 2025-06-02 [CVE-2025-1750](https://erroneo.us/security/cve/CVE-2025-1750/index.md) LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id — llama-index-vector-stores-duckdb >= 0.12.19, < 0.12.21 → 0.12.21
- 2025-05-20 [CVE-2025-46724](https://erroneo.us/security/cve/CVE-2025-46724/index.md) Langroid has a Code Injection vulnerability in TableChatAgent — langroid < 0.53.15 → 0.53.15
- 2025-05-20 [CVE-2025-47277](https://erroneo.us/security/cve/CVE-2025-47277/index.md) vLLM Allows Remote Code Execution via PyNcclPipe Communication Service — vllm >= 0.6.5, < 0.8.5 → 0.8.5
- 2025-05-14 [CVE-2024-24780](https://erroneo.us/security/cve/CVE-2024-24780/index.md) Apache IoTDB Vulnerable to Remote Code Execution — org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.4 → 1.3.4; apache-iotdb >= 1.0.0, < 1.3.4 → 1.3.4
- 2025-05-05 [CVE-2025-47241](https://erroneo.us/security/cve/CVE-2025-47241/index.md) Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL — browser-use <= 0.1.44 → 0.1.45
- 2025-04-29 [CVE-2025-32444](https://erroneo.us/security/cve/CVE-2025-32444/index.md) vLLM Vulnerable to Remote Code Execution via Mooncake Integration — vllm >= 0.6.5, < 0.8.5 → 0.8.5
- 2025-04-24 [CVE-2025-43859](https://erroneo.us/security/cve/CVE-2025-43859/index.md) h11 accepts some malformed Chunked-Encoding bodies — h11 < 0.16.0 → 0.16.0
- 2025-04-22 [GHSA-ggpf-24jw-3fcw](https://erroneo.us/security/ghsa/GHSA-ggpf-24jw-3fcw/index.md) CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0 — vllm < 0.8.0 → 0.8.0
- 2025-04-18 [CVE-2025-32434](https://erroneo.us/security/cve/CVE-2025-32434/index.md) PyTorch: `torch.load` with `weights_only=True` leads to remote code execution — torch < 2.6.0 → 2.6.0
- 2025-04-11 [CVE-2025-32428](https://erroneo.us/security/cve/CVE-2025-32428/index.md) TigerVNC accessible via the network and not just via a UNIX socket as intended — jupyter-remote-desktop-proxy = 3.0.0 → 3.0.1
- 2025-04-09 [CVE-2025-32375](https://erroneo.us/security/cve/CVE-2025-32375/index.md) BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization — bentoml >= 1.0.0a1, < 1.4.8 → 1.4.8
- 2025-04-07 [CVE-2025-32013](https://erroneo.us/security/cve/CVE-2025-32013/index.md) LNbits Lightning Network Payment System Vulnerable to Server-Side Request Forgery via LNURL Authentication Callback — lnbits <= 0.12.12 → no fix
- 2025-04-04 [CVE-2025-27520](https://erroneo.us/security/cve/CVE-2025-27520/index.md) BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization — bentoml >= 1.3.4, < 1.4.3 → 1.4.3
- 2025-04-03 [CVE-2025-2945](https://erroneo.us/security/cve/CVE-2025-2945/index.md) pgAdmin 4 Vulnerable to Remote Code Execution — pgadmin4 < 9.2 → 9.2
- 2025-04-03 [CVE-2025-2946](https://erroneo.us/security/cve/CVE-2025-2946/index.md) pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering — pgadmin4 < 9.2 → 9.2
- 2025-03-21 [CVE-2024-12029](https://erroneo.us/security/cve/CVE-2024-12029/index.md) InvokeAI Deserialization of Untrusted Data vulnerability — InvokeAI >= 5.3.1, < 5.4.3rc2 → 5.4.3rc2
- 2025-03-20 [CVE-2024-12909](https://erroneo.us/security/cve/CVE-2024-12909/index.md) llama-index-packs-finchat SQL Injection vulnerability — llama-index-packs-finchat <= 0.3.0 → no fix
- 2025-03-20 [CVE-2024-10835](https://erroneo.us/security/cve/CVE-2024-10835/index.md) DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users — dbgpt < 0.7.1 → 0.7.1
- 2025-03-20 [CVE-2024-9052](https://erroneo.us/security/cve/CVE-2024-9052/index.md) vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object — vllm <= 0.8.1 → no fix
- 2025-03-20 [CVE-2024-10190](https://erroneo.us/security/cve/CVE-2024-10190/index.md) Horovod Vulnerable to Command Injection — horovod <= 0.28.1 → no fix
- 2025-03-20 [CVE-2024-8551](https://erroneo.us/security/cve/CVE-2024-8551/index.md) AgentScope path traversal vulnerability in save-workflow — agentscope <= 0.1.1 → no fix
- 2025-03-20 [CVE-2024-10833](https://erroneo.us/security/cve/CVE-2024-10833/index.md) DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload — dbgpt < 0.6.2 → 0.6.2
- 2025-03-20 [CVE-2024-10831](https://erroneo.us/security/cve/CVE-2024-10831/index.md) DB-GPT Absolute Path Traversal vulnerability — dbgpt <= 0.6.0 → no fix
- 2025-03-20 [CVE-2024-10553](https://erroneo.us/security/cve/CVE-2024-10553/index.md) H2O Deserialization of Untrusted Data Vulnerability — h2o < 3.46.0.6 → 3.46.0.6; ai.h2o:h2o-core < 3.46.0.6 → 3.46.0.6
- 2025-03-20 [CVE-2024-9053](https://erroneo.us/security/cve/CVE-2024-9053/index.md) vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints — vllm <= 0.6.0 → no fix
- 2025-03-20 [CVE-2024-8537](https://erroneo.us/security/cve/CVE-2024-8537/index.md) AgentScope path traversal vulnerability — agentscope <= 0.1.1 → no fix
- 2025-03-20 [CVE-2024-8502](https://erroneo.us/security/cve/CVE-2024-8502/index.md) AgentScope Deserialization Vulnerability — agentscope <= 0.0.6a3 → no fix
- 2025-03-20 [CVE-2024-9070](https://erroneo.us/security/cve/CVE-2024-9070/index.md) BentoML deserialization vulnerability — bentoml <= 1.4.5 → no fix
- 2025-03-20 [CVE-2024-10901](https://erroneo.us/security/cve/CVE-2024-10901/index.md) DB-GPT Arbitrary File Write vulnerability — dbgpt <= 0.6.3 → no fix
- 2025-03-20 [CVE-2024-6829](https://erroneo.us/security/cve/CVE-2024-6829/index.md) Aim External Control of File Name or Path vulnerability — aim <= 3.19.3 → no fix
- 2025-03-20 [CVE-2024-9701](https://erroneo.us/security/cve/CVE-2024-9701/index.md) Kedro deserialization vulnerability — kedro < 0.19.9 → 0.19.9
- 2025-03-20 [CVE-2024-11041](https://erroneo.us/security/cve/CVE-2024-11041/index.md) vLLM Deserialization of Untrusted Data vulnerability — vllm <= 0.6.2 → no fix
- 2025-03-20 [CVE-2024-8769](https://erroneo.us/security/cve/CVE-2024-8769/index.md) Aim  path traversal in LockManager.release_locks — aim >= 3.15.0, <= 3.27.0 → no fix
- 2025-03-20 [CVE-2024-8019](https://erroneo.us/security/cve/CVE-2024-8019/index.md) PyTorch Lightning path traversal vulnerability — pytorch-lightning < 2.4.0 → 2.4.0
- 2025-03-20 [CVE-2024-10902](https://erroneo.us/security/cve/CVE-2024-10902/index.md) DB-GPT vulnerable to Arbitrary File Upload with Path Traversal — dbgpt <= 0.6.0 → no fix
- 2025-03-20 [CVE-2024-11958](https://erroneo.us/security/cve/CVE-2024-11958/index.md) LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection — llama-index-retrievers-duckdb-retriever < 0.4.0 → 0.4.0
- 2025-03-20 [CVE-2024-11042](https://erroneo.us/security/cve/CVE-2024-11042/index.md) InvokeAI Arbitrary File Deletion vulnerability — InvokeAI < 5.3.0rc1 → 5.3.0rc1
- 2025-03-19 [CVE-2025-29783](https://erroneo.us/security/cve/CVE-2025-29783/index.md) vLLM Allows Remote Code Execution via Mooncake Integration — vllm >= 0.6.5, < 0.8.0 → 0.8.0
- 2025-03-14 [CVE-2025-2000](https://erroneo.us/security/cve/CVE-2025-2000/index.md) Qiskit allows arbitrary code execution decoding QPY format versions < 13 — qiskit-terra >= 0.18.0, <= 0.46.3 → no fix; qiskit <= 1.4.1 → 1.4.2; qiskit = 2.0.0rc1 → 2.0.0rc2
- 2025-03-10 [CVE-2025-1497](https://erroneo.us/security/cve/CVE-2025-1497/index.md) PlotAI eval vulnerability — plotai < 0.0.7 → 0.0.7
- 2025-02-25 [CVE-2023-25574](https://erroneo.us/security/cve/CVE-2023-25574/index.md) LTI JupyterHub Authenticator does not properly validate JWT Signature — jupyterhub-ltiauthenticator = 1.3.0 → 1.4.0
- 2025-02-11 [CVE-2024-12366](https://erroneo.us/security/cve/CVE-2024-12366/index.md) PandasAI interactive prompt function Remote Code Execution (RCE) — pandasai <= 2.4.2 → no fix
- 2025-02-03 [CVE-2025-24370](https://erroneo.us/security/cve/CVE-2025-24370/index.md) Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass — django-unicorn < 0.62.0 → 0.62.0
- 2025-01-15 [CVE-2025-22146](https://erroneo.us/security/cve/CVE-2025-22146/index.md) Sentry's improper authentication on SAML SSO process allows user impersonation — sentry >= 21.12.0, < 25.1.0 → 25.1.0
- 2025-01-14 [CVE-2025-23042](https://erroneo.us/security/cve/CVE-2025-23042/index.md) Gradio Blocked Path ACL Bypass Vulnerability — gradio < 5.11.0 → 5.11.0
- 2025-01-14 [CVE-2024-49375](https://erroneo.us/security/cve/CVE-2024-49375/index.md) Rasa Allows Remote Code Execution via Remote Model Loading — rasa-pro >= 3.10.0, < 3.10.12 → 3.10.12; rasa-pro >= 3.9.0, < 3.9.16 → 3.9.16; rasa-pro < 3.8.18 → 3.8.18
- 2024-11-18 [CVE-2024-47533](https://erroneo.us/security/cve/CVE-2024-47533/index.md) cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes — cobbler >= 3.3.0, < 3.3.7 → 3.3.7; cobbler >= 3.0.0, < 3.2.3 → 3.2.3
- 2024-11-06 [CVE-2024-10082](https://erroneo.us/security/cve/CVE-2024-10082/index.md) codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service — codechecker <= 6.24.1 → 6.24.2
- 2024-11-06 [CVE-2024-10081](https://erroneo.us/security/cve/CVE-2024-10081/index.md) codechecker vulnerable to authentication bypass when using specifically crafted URLs — codechecker < 6.24.2 → 6.24.2
- 2024-10-29 [CVE-2024-49768](https://erroneo.us/security/cve/CVE-2024-49768/index.md) Waitress has request processing race condition in HTTP pipelining with invalid first request — waitress >= 2.0.0, < 3.0.1 → 3.0.1
- 2024-10-15 [CVE-2024-32651](https://erroneo.us/security/cve/CVE-2024-32651/index.md) changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution — changedetection.io <= 0.45.20 → 0.45.21
- 2024-09-25 [CVE-2024-1728](https://erroneo.us/security/cve/CVE-2024-1728/index.md) Gradio allows users to access arbitrary files — gradio < 4.19.2 → 4.19.2
- 2024-09-18 [CVE-2024-46946](https://erroneo.us/security/cve/CVE-2024-46946/index.md) LangChain Experimental Eval Injection vulnerability — langchain-experimental >= 0.1.17, <= 0.3.0 → no fix
- 2024-09-11 [CVE-2024-6091](https://erroneo.us/security/cve/CVE-2024-6091/index.md) AutoGPT bypass of the shell commands denylist settings — agpt <= 0.5.1 → no fix
- 2024-09-09 [CVE-2024-39205](https://erroneo.us/security/cve/CVE-2024-39205/index.md) pyload-ng vulnerable to RCE with js2py sandbox escape — pyload-ng <= 0.5.0b3.dev85 → no fix
- 2024-09-06 [CVE-2024-45758](https://erroneo.us/security/cve/CVE-2024-45758/index.md) H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL — ai.h2o:h2o-core <= 3.46.0.7 → no fix; h2o <= 3.46.0.7 → no fix
- 2024-08-22 [CVE-2024-45201](https://erroneo.us/security/cve/CVE-2024-45201/index.md) LlamaIndex includes an exec call for `import {cls_name}` — llama-index-core < 0.10.38 → 0.10.38
- 2024-08-07 [CVE-2024-42005](https://erroneo.us/security/cve/CVE-2024-42005/index.md) Django SQL injection vulnerability — Django >= 5.0, < 5.0.8 → 5.0.8; Django >= 4.2, < 4.2.15 → 4.2.15
- 2024-07-18 [CVE-2024-35198](https://erroneo.us/security/cve/CVE-2024-35198/index.md) TorchServe vulnerable to bypass of allowed_urls configuration — torchserve < 0.11.0 → 0.11.0
- 2024-07-16 [GHSA-q5fm-55c2-v6j9](https://erroneo.us/security/ghsa/GHSA-q5fm-55c2-v6j9/index.md) Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib — fiona < 1.10b1 → 1.10b1
- 2024-07-14 [CVE-2024-21513](https://erroneo.us/security/cve/CVE-2024-21513/index.md) langchain-experimental vulnerable to Arbitrary Code Execution — langchain-experimental >= 0, < 0.0.21 → 0.0.21
- 2024-06-27 [CVE-2024-5826](https://erroneo.us/security/cve/CVE-2024-5826/index.md) vanna vulnerable to remote code execution caused by prompt injection — vanna <= 0.6.2 → no fix
- 2024-06-27 [CVE-2024-5980](https://erroneo.us/security/cve/CVE-2024-5980/index.md) pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint — lightning <= 2.3.1 → 2.3.3
- 2024-06-27 [CVE-2024-5751](https://erroneo.us/security/cve/CVE-2024-5751/index.md) litellm vulnerable to remote code execution based on using eval unsafely — litellm < 1.40.16 → 1.40.16
- 2024-06-22 [CVE-2024-5443](https://erroneo.us/security/cve/CVE-2024-5443/index.md) Remote Code Execution via path traversal bypass in lollms — lollms >= 5.9.0, < 9.5.1 → 9.5.1
- 2024-06-12 [CVE-2024-36265](https://erroneo.us/security/cve/CVE-2024-36265/index.md) Apache Submarine Server Core Incorrect Authorization vulnerability — org.apache.submarine:submarine-server-core = 0.8.0 → no fix; apache-submarine = 0.8.0 → no fix
- 2024-06-11 [CVE-2024-4315](https://erroneo.us/security/cve/CVE-2024-4315/index.md) parisneo/lollms Local File Inclusion (LFI) attack — lollms < 9.5.0 → 9.5.0
- 2024-06-11 [CVE-2024-35225](https://erroneo.us/security/cve/CVE-2024-35225/index.md) Jupyter Server Proxy has a reflected XSS issue in host parameter — jupyter-server-proxy >= 3.0.0, < 3.2.4 → 3.2.4; jupyter-server-proxy >= 4.0.0, < 4.2.0 → 4.2.0
- 2024-06-06 [CVE-2024-5452](https://erroneo.us/security/cve/CVE-2024-5452/index.md) Remote code execution in pytorch lightning — lightning < 2.3.3 → 2.3.3
- 2024-06-06 [CVE-2024-0520](https://erroneo.us/security/cve/CVE-2024-0520/index.md) Remote code execution in mlflow — mlflow < 2.9.0 → 2.9.0
- 2024-06-03 [CVE-2024-3829](https://erroneo.us/security/cve/CVE-2024-3829/index.md) qdrant input validation failure — qdrant-client < 1.9.0 → 1.9.0
- 2024-05-31 [CVE-2024-5565](https://erroneo.us/security/cve/CVE-2024-5565/index.md) Vanna prompt injection code execution — vanna <= 0.5.5 → no fix
- 2024-05-28 [CVE-2024-35374](https://erroneo.us/security/cve/CVE-2024-35374/index.md) Mocodo vulnerable to SQL injection in `/web/generate.php` — mocodo <= 4.2.6 → 4.2.7
- 2024-05-21 [CVE-2024-36039](https://erroneo.us/security/cve/CVE-2024-36039/index.md) PyMySQL SQL Injection vulnerability — pymysql < 1.1.1 → 1.1.1
- 2024-05-21 [CVE-2024-35059](https://erroneo.us/security/cve/CVE-2024-35059/index.md) NASA AIT-Core vulnerable to remote code execution — ait-core <= 2.5.2 → no fix
- 2024-05-21 [CVE-2024-35057](https://erroneo.us/security/cve/CVE-2024-35057/index.md) NASA AIT-Core vulnerable to remote code execution — ait-core <= 2.5.2 → no fix
- 2024-05-21 [CVE-2024-35056](https://erroneo.us/security/cve/CVE-2024-35056/index.md) NASA AIT-Core vulnerable to SQL Injection — ait-core <= 2.5.2 → no fix
- 2024-05-21 [CVE-2024-35058](https://erroneo.us/security/cve/CVE-2024-35058/index.md) NASA AIT-Core vulnerable to remote code execution — ait-core <= 2.5.2 → no fix
- 2024-05-16 [CVE-2024-5023](https://erroneo.us/security/cve/CVE-2024-5023/index.md) ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command — consoleme < 1.4.0 → 1.4.0
- 2024-05-13 [CVE-2024-34359](https://erroneo.us/security/cve/CVE-2024-34359/index.md) llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata — llama-cpp-python >= 0.2.30, <= 0.2.71 → 0.2.72
- 2024-05-09 [CVE-2024-32874](https://erroneo.us/security/cve/CVE-2024-32874/index.md) Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service — frigate < 0.13.2 → 0.13.2
- 2024-05-06 [CVE-2024-34249](https://erroneo.us/security/cve/CVE-2024-34249/index.md) pywasm3 contains a heap buffer overflow which leads to segmentation fault — pywasm3 <= 0.5.0 → no fix
- 2024-05-06 [CVE-2024-34252](https://erroneo.us/security/cve/CVE-2024-34252/index.md) pywasm3 contains a global buffer overflow which leads to segmentation fault — pywasm3 <= 0.5.0 → no fix
- 2024-05-02 [CVE-2024-3955](https://erroneo.us/security/cve/CVE-2024-3955/index.md) CraftBeerPi 4 allows arbitrary code execution — cbpi4 >= 4.0.0.58, < 4.4.1.a1 → 4.4.1.a1
- 2024-04-25 [CVE-2024-33663](https://erroneo.us/security/cve/CVE-2024-33663/index.md) python-jose algorithm confusion with OpenSSH ECDSA keys — python-jose < 3.4.0 → 3.4.0
- 2024-04-24 [CVE-2024-32880](https://erroneo.us/security/cve/CVE-2024-32880/index.md) pyLoad allows upload to arbitrary folder lead to RCE — pyload-ng <= 0.5.0 → no fix
- 2024-04-16 [CVE-2024-3660](https://erroneo.us/security/cve/CVE-2024-3660/index.md) Keras code injection vulnerability — keras < 2.13.1rc0 → 2.13.1rc0
- 2024-04-15 [CVE-2024-3271](https://erroneo.us/security/cve/CVE-2024-3271/index.md) llama-index-core Command Injection vulnerability — llama-index-core < 0.10.24 → 0.10.24
- 2024-04-15 [CVE-2024-2912](https://erroneo.us/security/cve/CVE-2024-2912/index.md) Insecure deserialization in BentoML — bentoml < 1.2.5 → 1.2.5
- 2024-04-15 [CVE-2024-3573](https://erroneo.us/security/cve/CVE-2024-3573/index.md) mlflow vulnerable to Path Traversal — mlflow < 2.10.0 → 2.10.0
- 2024-04-15 [CVE-2024-2083](https://erroneo.us/security/cve/CVE-2024-2083/index.md) Directory traversal in zenml — zenml < 0.55.5 → 0.55.5
- 2024-04-10 [CVE-2024-3098](https://erroneo.us/security/cve/CVE-2024-3098/index.md) llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution — llama-index-core < 0.10.24 → 0.10.24
- 2024-04-10 [CVE-2024-2195](https://erroneo.us/security/cve/CVE-2024-2195/index.md) Aim Web API vulnerable to Remote Code Execution — aim >= 3.0.0, <= 3.25.0 → no fix
- 2024-04-10 [CVE-2024-2952](https://erroneo.us/security/cve/CVE-2024-2952/index.md) LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint — litellm < 1.34.42 → 1.34.42
- 2024-03-26 [CVE-2024-28335](https://erroneo.us/security/cve/CVE-2024-28335/index.md) Lektor does not sanitize database path traversal — Lektor >= 0, < 3.3.11 → 3.3.11; Lektor >= 3.4.0b1, < 3.4.0b11 → 3.4.0b11
- 2024-03-20 [CVE-2024-28179](https://erroneo.us/security/cve/CVE-2024-28179/index.md) Jupyter Server Proxy's Websocket Proxying does not require authentication — jupyter-server-proxy >= 4.0.0, < 4.1.1 → 4.1.1; jupyter-server-proxy < 3.2.3 → 3.2.3
- 2024-03-14 [CVE-2024-22203](https://erroneo.us/security/cve/CVE-2024-22203/index.md) Whoogle Search Path Traversal vulnerability — whoogle-search >= 0, < 0.8.4 → 0.8.4
- 2024-03-14 [CVE-2024-22205](https://erroneo.us/security/cve/CVE-2024-22205/index.md) Whoogle Search Server-Side Request Forgery vulnerability — whoogle-search >= 0, < 0.8.4 → 0.8.4
- 2024-03-07 [CVE-2024-2044](https://erroneo.us/security/cve/CVE-2024-2044/index.md) pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user — pgAdmin4 < 8.4 → 8.4
- 2024-03-07 [CVE-2024-0917](https://erroneo.us/security/cve/CVE-2024-0917/index.md) PaddlePaddle vulnerable to remote code execution — paddlepaddle <= 2.6.0 → no fix

Pages: https://erroneo.us/security/ecosystem/pypi/index.md · https://erroneo.us/security/ecosystem/pypi/2/index.md · https://erroneo.us/security/ecosystem/pypi/3/index.md · https://erroneo.us/security/ecosystem/pypi/4/index.md · https://erroneo.us/security/ecosystem/pypi/5/index.md

---
Source page: https://erroneo.us/security/ecosystem/pypi/4/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt