Fix HIGH and CRITICAL vulnerabilities for Python

Fix vulnerabilities identified by Snyk in [email protected] Python dependencies

After upgrading to [email protected] we ran a Snyk scan and identified 28 vulnerabilities across 12 transitive Python dependencies. We'd appreciate these being addressed upstream by bumping the affected package versions. Details below.

---

Summary

Package	Current Version	Vulnerabilities	Fixed Version
gitpython	3.1.41	SNYK-PYTHON-GITPYTHON-6150177 (Critical), SNYK-PYTHON-GITPYTHON-5840436 (High), SNYK-PYTHON-GITPYTHON-3113858 (High), SNYK-PYTHON-GITPYTHON-5964360 (High)	3.1.49
jupyter-server	2.14.1	CVE-2024-35178 (Critical), SNYK-PYTHON-JUPYTERSERVER-7619232 (High), SNYK-PYTHON-JUPYTERSERVER-7619233 (High)	2.18.0
pyjwt	2.6.0	CVE-2024-33663 (High)	2.12.0
tornado	6.4.2	SNYK-PYTHON-TORNADO-7908559 (High x2), SNYK-PYTHON-TORNADO-7908560 (High), SNYK-PYTHON-TORNADO-7908561 (High), SNYK-PYTHON-TORNADO-8067494 (Medium), SNYK-PYTHON-TORNADO-8067495 (Medium)	6.5.5
aiohttp	3.10.0	CVE-2024-52304 (High), CVE-2024-52303 (High), CVE-2024-23334 (Medium)	3.12.14
pillow	10.3.0	CVE-2024-28219 (High), CVE-2025-3167 (High x2), CVE-2024-28219 (Medium)	12.2.0
cryptography	42.0.4	CVE-2024-26130 (High), CVE-2024-0727 (Low x2)	43.0.1
jinja2	3.1.3	CVE-2024-56326 (Medium x2), CVE-2024-56201 (Medium), CVE-2024-22195 (Medium)	3.1.6
requests	2.31.0	CVE-2024-35195 (Medium), CVE-2023-32681 (Medium), SNYK-PYTHON-REQUESTS-6928867 (Medium)	2.33.0
werkzeug	3.0.3	CVE-2024-49766 (Medium), CVE-2024-49767 (Medium x2), CVE-2025-27516 (Medium)	3.1.5
setuptools	70.0.0	CVE-2024-6345 (Medium)	78.1.1
paramiko	3.5.1	CVE-2025-43859 (Low)	5.0.0

---

Detailed Breakdown

1. [email protected]

• Vulnerabilities:
  • (Critical) Arbitrary Argument Injection (CWE-88, CVSS 9.2) — maliciously crafted remote URLs can inject arbitrary arguments into git commands
  • (High) Command Injection (CWE-78, CVSS 8.7) — unsafe use of Popen with shell=True allows OS command injection
  • (High) Directory Traversal (CWE-22, CVSS 8.8) — symlink attacks during clone operations can escape the target directory
  • (High) Arbitrary Code Injection (CWE-94, CVSS 8.5) — specially crafted .git config files can lead to code execution
• Fixed version: 3.1.49

---

2. [email protected]

• Vulnerabilities:
  • (Critical) Directory Traversal (CWE-22, CVSS 9.2) — unauthenticated path traversal allows arbitrary file reads on the server
  • (High) Insufficient Session Expiration (CWE-613, CVSS 7.6) — tokens remain valid after logout, enabling session hijacking
  • (High) Regex without Anchors (CWE-777, CVSS 7.6) — authentication bypass via improperly anchored regex patterns
• Fixed version: 2.18.0

---

3. [email protected]

• Vulnerabilities:
  • (High) Improper Cryptographic Signature Verification (CWE-347, CVSS 8.7) — algorithm confusion attack allows forging valid JWT tokens without the secret key
• Fixed version: 2.12.0

---

4. [email protected]

• Vulnerabilities:
  • (High) Resource Exhaustion x2 (CWE-770, CVSS 8.7) — unbounded memory allocation via crafted HTTP requests enables DoS
  • (High) Excessive Iteration (CWE-834, CVSS 8.7) — malformed multipart bodies cause infinite loops
  • (High) Inefficient Algorithmic Complexity (CWE-407, CVSS 8.7) — quadratic complexity in header parsing enables CPU exhaustion
  • (Medium) HTTP Header Injection (CWE-644, CVSS 5.3) — unsanitized values allow injection of arbitrary HTTP response headers
  • (Medium) Parameter Injection (CWE-625, CVSS 5.3) — crafted URLs can inject unexpected query parameters
• Fixed version: 6.5.5

---

5. [email protected]

• Vulnerabilities:
  • (High) HTTP Request Smuggling x2 (CWE-444, CVSS 8.2) — malformed chunked encoding allows request smuggling attacks against reverse proxies
  • (Medium) Symlink Following (CWE-61, CVSS 6.3) — static file serving follows symlinks outside the designated directory
• Fixed version: 3.12.14

---

6. [email protected]

• Vulnerabilities:
  • (High) Resource Exhaustion (CWE-770, CVSS 8.7) — maliciously crafted images trigger unbounded memory allocation
  • (High) Out-of-bounds Write x2 (CWE-787/CWE-190, CVSS 8.5) — integer overflow in image processing leads to heap corruption
  • (Medium) Infinite Loop (CWE-835, CVSS 6.9) — crafted image files cause the decoder to loop indefinitely
• Fixed version: 12.2.0

---

7. [email protected]

• Vulnerabilities:
  • (High) Type Confusion (CWE-843, CVSS 8.2) — malformed certificates trigger a type confusion bug in the X.509 parser
  • (Low) Resource Exhaustion x2 (CWE-400, CVSS 3.7) — crafted RSA/DSA keys cause excessive CPU consumption during parsing
• Fixed version: 43.0.1

---

8. [email protected]

• Vulnerabilities:
  • (Medium) Template Injection x2 (CWE-1336, CVSS 5.4) — sandbox escape via crafted template expressions allows arbitrary code execution
  • (Medium) Improper Neutralization (CWE-150, CVSS 5.4) — filter bypasses allow unintended output rendering
  • (Medium) Cross-site Scripting / XSS (CWE-79, CVSS 5.4) — unescaped user input in certain autoescape contexts leads to XSS
• Fixed version: 3.1.6

---

9. [email protected]

• Vulnerabilities:
  • (Medium) Sensitive Info Exposure (CWE-201, CVSS 5.7) — Authorization headers leaked to third-party redirects
  • (Medium) Incorrect Control Flow (CWE-670, CVSS 5.6) — proxy authentication bypass under certain redirect conditions
  • (Medium) Insecure Temporary File (CWE-377, CVSS 4.1) — predictable temp file names during session handling
• Fixed version: 2.33.0

---

10. [email protected]

• Vulnerabilities:
  • (Medium) Resource Exhaustion (CWE-770, CVSS 6.9) — unbounded multipart form parsing causes memory exhaustion
  • (Medium) Directory Traversal (CWE-22, CVSS 6.3) — path normalization bypass allows reading files outside the web root
  • (Medium) Improper Handling of Windows Device Names x2 (CWE-67, CVSS 6.3) — reserved Windows filenames (e.g. CON, NUL) cause unexpected behavior in routing
• Fixed version: 3.1.5

---

11. [email protected]

• Vulnerabilities:
  • (Medium) Directory Traversal (CWE-22, CVSS 6.8) — arbitrary file write via crafted wheel filenames during package installation
• Fixed version: 78.1.1

---

12. [email protected]

• Vulnerabilities:
  • (Low) Broken Cryptographic Algorithm (CWE-327, CVSS 2.3) — use of weak legacy algorithms (SHA-1, MD5) in key exchange
• Fixed version: 5.0.0

License

Package	Issue	Fix
[email protected]	Bundled as GPL-2.0	upgrade to 0.22.1

---

no fix available

• [email protected] — HPND license flag; verify compatibility with your project license